Fix usbmux Binary and Plist protocol interoperability

* Make InternalBlue start with ADBCore in Python 3
* Make InternalBlue start with HCICore in Python 3
* Substitute var.decode('hex') with bytearray.fromhex(var) in most places I found which works in Python 2 and 3 and performs the same task
* Substitute var.encode('hex') with new byte_to_hex function that works with Python 2 and 3 (in util.py)
* Declare variables explicitly as bytes instead of strings
* Fix small issue in macOS Core (explicit declaration of variable as byte)

.gitignore

@@ -17,3 +17,11 @@ btsnoop.log
 # xcode
 xcuserdata
 *.xcworkspace
+macos-framework/IOBluetoothExtended.framework/
+
+# venv
+venv
+venv3
+
+# pycharm
+*.idea

README.md

@@ -8,6 +8,14 @@ therefore implement monitoring and injection tools for the lower layers of
 the Bluetooth protocol stack.
 
 
+Recent Changes
+--------------
+* We upgraded from Python 2 to Python 3. If you wrote your own scripts, this might break them. In this case, use
+  the [python2](https://github.com/seemoo-lab/internalblue/releases/tag/python2) release.
+
+* We reworked the *iOS* implementation.
+
+
 Publications and Background
 ---------------------------
 
@@ -54,6 +62,20 @@ was also recorded and gives a more high level overview.
 
   Our talk [Playing with Bluetooth](https://media.ccc.de/v/2019-185-playing-with-bluetooth) focuses on new device support
   within *InternalBlue* and the Patchram state of various devices.
+  
+* **36C3 Talk** (12/2019)
+  
+  The rather generic talk [All wireless communication stacks are equally broken](https://media.ccc.de/v/36c3-10531-all_wireless_communication_stacks_are_equally_broken)
+  points out a couple of new research directions and new Bluetooth projects coming up.
+
+* **EWSN Paper & Demo** (02/2020)
+
+  We did some work on improving blacklisting performance of BLE data connections. Currently in a separate *blacklisting* branch.
+
+* **CiderSecCon Talk** (03/2020)
+
+  TROOPERS was canceled, but we did a stream of a talk that was recorded on [YouTube](https://www.youtube.com/watch?v=Nx2ZDLaJ1-0&t=4920).
+  
 
 
 Supported Features
@@ -87,6 +109,7 @@ On selected Broadcom Bluetooth chips:
   * NiNo example
   * MAC address filter example
 * KNOB attack test for various devices, including Raspberry Pi 3+/4
+* BLE receptoin statistics
 
 A comprehensive list of chips and which devices have them can be found in the [firmware](internalblue/fw/README.md) module documentation.
 
@@ -99,19 +122,20 @@ Requirements
 Android:
 * Ideally recompiled `bluetooth.default.so`, but also works on any rooted smartphone, see [Android instructions](android_bluetooth_stack/README.md)
 * Android device connected via ADB
-* Best support is currently given for Nexus 5 / BCM4339 and Evaluation Boards
+* Best support is currently given for Nexus 5 / BCM4339
 * Optional: Patch for Android driver to support Broadcom H4 forwarding
 * Optional, if H4: Wireshark [Broadcom H4 Dissector Plugin](https://github.com/seemoo-lab/h4bcm_wireshark_dissector)
 
 Linux:
 * BlueZ, instructions see [here](linux_bluez/README.md)
-* Best support for Raspberry Pi 3/3+/4
+* Best support for Raspberry Pi 3/3+/4 and Cypress evaluation boards
 * For most commands: Privileged access
 
 iOS:
-* A jailbroken iOS device (tested on iOS 12.1.2/12.4 with iPhone 6, SE, 7, 8, X)
-* The included `ios-proxy` (instructions in [here](ios-proxy/README.md))
-* Optional: a Mac with `xcode` to compile the proxy yourself
+* A jailbroken iOS device (tested on iOS 12 and 13 with iPhone 6, SE, 7, 8, X , does not work on iPhones newer than XR, these devices have a Bluetooth chip connected via PCIe)
+* `usbmuxd`, which is pre installed on macOS but is available on most Linux distributions as well. Alternatively it can be obtained from [here](https://github.com/libimobiledevice/usbmuxd).
+* The [``internalblued`` daemon](ios-internalblued/README.md) installed on the iOS device
+
 * Optional, no jailbreak required: install [iOS Bluetooth Debug Profile](https://developer.apple.com/bug-reporting/profiles-and-logs/) to obtain
   HCI and diagnostic messages, either via diagnostic report feature (all iOS versions) or live with PacketLogger (since iOS 13)
 
@@ -140,7 +164,7 @@ with all dependencies by using pip:
 
     git clone https://github.com/seemoo-lab/internalblue.git
     cd internalblue
-    pip2 install .
+    pip install .
 
 It will install the following dependencies:
 * pwntools
@@ -160,7 +184,7 @@ All steps on a plain Ubuntu 18.04:
     sudo apt install git python-setuptools binutils-arm-linux-gnueabi adb pip python-dev gcc
     git clone https://github.com/seemoo-lab/internalblue
     cd internalblue
-    sudo pip2 install .
+    sudo pip install .
     cd ..
     
     sudo apt-get install wireshark-dev wireshark cmake
@@ -184,7 +208,7 @@ Usage
 
 The CLI (Command Line Interface) of InternalBlue can be started by running:
 
-    python2 -m internalblue.cli
+    python -m internalblue.cli
 
 The setup.py installation will also place a shortcut to the CLI into the $PATH
 so that it can be started from a command line using:
@@ -214,7 +238,7 @@ can replace them with anything you want.
 License
 -------
 
-Copyright 2018-2019 Dennis Mantz, Jiska Classen
+Copyright 2018-2020 The InternalBlue Team
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

examples/nexus5/BLE_Reception_PoC.py

@@ -4,6 +4,7 @@
 
 # Get receive statistics on a Nexus 5 for BLE connection events
 
+from builtins import range
 from pwn import *
 from internalblue.adbcore import ADBCore
 import internalblue.hci as hci

examples/s8/BLE_Reception_PoC.py

@@ -4,6 +4,7 @@
 
 # Get receive statistics on a Samsung Galaxy S8 for BLE connection events
 
+from builtins import range
 from pwn import *
 from internalblue.adbcore import ADBCore
 import internalblue.hci as hci

internalblue/__init__.py

@@ -1 +1,54 @@
+from future import standard_library
 
+standard_library.install_aliases()
+
+import datetime
+
+from queue import Queue
+from typing import (
+    List,
+    Optional,
+    Any,
+    TYPE_CHECKING,
+    Tuple,
+    Union,
+    NewType,
+    Callable,
+    Dict,
+)
+
+# Address = NewType("Address", int)
+Address = int
+ConnectionNumber = NewType("ConnectionNumber", int)
+ConnectionIndex = NewType("ConnectionIndex", int)
+
+BluetoothAddress = NewType("BluetoothAddress", bytes)
+ConnectionDict = NewType("ConnectionDict", Dict[str, Any])
+HeapInformation = NewType("HeapInformation", Dict[str, Any])
+QueueInformation = NewType("QueueInformation", Dict[str, Any])
+
+try:
+
+    if TYPE_CHECKING:
+        from internalblue.hci import HCI
+        from internalblue.core import InternalBlue
+
+        Record = Tuple[HCI, int, int, int, Any, datetime.datetime]
+        FilterFunction = Callable[[Record], bool]
+
+        Opcode = NewType("Opcode", int)
+        HCI_CMD = NewType("HCI_CMD", int)
+        Task = Tuple[HCI_CMD, bytes, Queue, Callable[[Record], bool]]
+
+        Device = NewType("Device", Dict[str, Any])
+        """{"dev_id": dev_id,
+         "dev_name": dev_name,
+         "dev_bdaddr": dev_bdaddr,
+         "dev_flags": dev_flags,
+         "dev_flags_str": dev_flags_str}"""
+        # InternalBlueCore, Device Name, SomeString
+        DeviceTuple = Tuple[InternalBlue, str, str]
+
+
+except:
+    pass

internalblue/adbcore.py

@@ -1,22 +1,48 @@
 #!/usr/bin/env python2
+import struct
+from time import sleep
+from typing import Optional
 
+from future import standard_library
+
+from pwnlib import adb
+from pwnlib.exception import PwnlibException
+
+standard_library.install_aliases()
+from builtins import str
 import datetime
 import socket
-import Queue
+import queue as queue2k
 import random
-import hci
+from internalblue import hci
+from internalblue.utils import bytes_to_hex
 
-from pwn import *
 
-from core import InternalBlue
+from internalblue.utils.pwnlib_wrapper import log, context, u32
+from .core import InternalBlue
 
 
 class ADBCore(InternalBlue):
-
-    def __init__(self, queue_size=1000, btsnooplog_filename='btsnoop.log', log_level='info', fix_binutils='True', serial=False, data_directory="."):
-        super(ADBCore, self).__init__(queue_size, btsnooplog_filename, log_level, fix_binutils, data_directory)
-        self.hciport = None     # hciport is the port number of the forwarded HCI snoop port (8872). The inject port is at hciport+1
-        self.serial = serial    # use serial su busybox scripting and do not try bluetooth.default.so
+    def __init__(
+        self,
+        queue_size=1000,
+        btsnooplog_filename="btsnoop.log",
+        log_level="info",
+        fix_binutils="True",
+        serial=False,
+        data_directory=".",
+        replay=False,
+    ):
+        super(ADBCore, self).__init__(
+            queue_size,
+            btsnooplog_filename,
+            log_level,
+            fix_binutils,
+            data_directory,
+            replay,
+        )
+        self.hciport: Optional[int] = None  # hciport is the port number of the forwarded HCI snoop port (8872). The inject port is at hciport+1
+        self.serial = serial  # use serial su busybox scripting and do not try bluetooth.default.so
         self.doublecheck = False
 
     def device_list(self):
@@ -31,15 +57,19 @@ class ADBCore(InternalBlue):
             log.warn("Already running. call shutdown() first!")
             return []
 
+        if self.replay:
+            return [(self, "adb_replay", "adb: ReplayDevice")]
         # Check for connected adb devices
         try:
             adb_devices = adb.devices()
         except ValueError:
-            log.info("Could not find devices with pwnlib. If you see devices with `adb devices`, try to remove the lines 'for field in fields[2:]:... = v' in `pwnlib/adb/adb.py`.")
+            log.info(
+                "Could not find devices with pwnlib. If you see devices with `adb devices`, try to remove the lines 'for field in fields[2:]:... = v' in `pwnlib/adb/adb.py`."
+            )
             adb_devices = 0
         except:
             adb_devices = 0
-        
+
         if adb_devices == 0 or len(adb_devices) == 0:
             log.info("No adb devices found.")
             return []
@@ -53,7 +83,7 @@ class ADBCore(InternalBlue):
         # Third index is the label which is shown in options(...)
         device_list = []
         for d in adb_devices:
-            device_list.append((self, d.serial, 'adb: %s (%s)' % (d.serial, d.model)))
+            device_list.append((self, d.serial, "adb: %s (%s)" % (d.serial, d.model)))
 
         return device_list
 
@@ -71,7 +101,9 @@ class ADBCore(InternalBlue):
         if not self.serial:
             if not self._setupSockets():
                 log.info("Could not connect using Bluetooth module.")
-                log.info("Trying to set up connection for rooted smartphone with busybox installed.")
+                log.info(
+                    "Trying to set up connection for rooted smartphone with busybox installed."
+                )
             else:
                 return True  # successfully finished setup with bluetooth.default.so
 
@@ -82,7 +114,9 @@ class ADBCore(InternalBlue):
         # try again
         if not self._setupSockets():
             log.critical("No connection to target device.")
-            log.info("Check if:\n -> Bluetooth is active\n -> Bluetooth Stack has Debug Enabled\n -> BT HCI snoop log is activated\n -> USB debugging is authorized\n")
+            log.info(
+                "Check if:\n -> Bluetooth is active\n -> Bluetooth Stack has Debug Enabled\n -> BT HCI snoop log is activated\n -> USB debugging is authorized\n"
+            )
             return False
 
         return True
@@ -93,13 +127,17 @@ class ADBCore(InternalBlue):
         """
 
         data = self.s_snoop.recv(16)
-        if(len(data) < 16):
+        if len(data) < 16:
             return None
-        if(self.write_btsnooplog) and self.btsnooplog_file.tell() == 0:
+        if (self.write_btsnooplog) and self.btsnooplog_file.tell() == 0:
             self.btsnooplog_file.write(data)
             self.btsnooplog_file.flush()
 
-        btsnoop_hdr = (data[:8], u32(data[8:12],endian="big"),u32(data[12:16],endian="big"))
+        btsnoop_hdr = (
+            data[:8],
+            u32(data[8:12], endian="big"),
+            u32(data[12:16], endian="big"),
+        )
         log.debug("BT Snoop Header: %s, version: %d, data link type: %d" % btsnoop_hdr)
         return btsnoop_hdr
 
@@ -115,7 +153,9 @@ class ADBCore(InternalBlue):
         this field as 0x00E03AB44A676000.
         """
         time_betw_0_and_2000_ad = int("0x00E03AB44A676000", 16)
-        time_since_2000_epoch = datetime.timedelta(microseconds=time) - datetime.timedelta(microseconds=time_betw_0_and_2000_ad)
+        time_since_2000_epoch = datetime.timedelta(
+            microseconds=time
+        ) - datetime.timedelta(microseconds=time_betw_0_and_2000_ad)
         return datetime.datetime(2000, 1, 1) + time_since_2000_epoch
 
     def _recvThreadFunc(self):
@@ -135,18 +175,23 @@ class ADBCore(InternalBlue):
             context.log_level = self.log_level
 
             # Read the record header
-            record_hdr = b''
-            while(not self.exit_requested and len(record_hdr) < 24):
+            record_hdr = b""
+            while not self.exit_requested and len(record_hdr) < 24:
                 try:
                     recv_data = self.s_snoop.recv(24 - len(record_hdr))
-                    log.debug("recvThreadFunc: received bt_snoop data " + recv_data.encode('hex'))
+                    log.debug(
+                        "recvThreadFunc: received bt_snoop data "
+                        + bytes_to_hex(recv_data)
+                    )
                     if len(recv_data) == 0:
-                        log.info("recvThreadFunc: bt_snoop socket was closed by remote site. stopping recv thread...")
+                        log.info(
+                            "recvThreadFunc: bt_snoop socket was closed by remote site. stopping recv thread..."
+                        )
                         self.exit_requested = True
                         break
                     record_hdr += recv_data
                 except socket.timeout:
-                    pass # this is ok. just try again without error
+                    pass  # this is ok. just try again without error
 
             if not record_hdr or len(record_hdr) != 24:
                 if not self.exit_requested:
@@ -158,27 +203,31 @@ class ADBCore(InternalBlue):
                 self.btsnooplog_file.write(record_hdr)
                 self.btsnooplog_file.flush()
 
-            orig_len, inc_len, flags, drops, time64 = struct.unpack( ">IIIIq", record_hdr)
+            orig_len, inc_len, flags, drops, time64 = struct.unpack(
+                ">IIIIq", record_hdr
+            )
 
             # Read the record data
-            record_data = b''
-            while(not self.exit_requested and len(record_data) < inc_len):
+            record_data = bytearray()
+            while not self.exit_requested and len(record_data) < inc_len:
                 try:
                     recv_data = self.s_snoop.recv(inc_len - len(record_data))
                     if len(recv_data) == 0:
-                        log.info("recvThreadFunc: bt_snoop socket was closed by remote site. stopping..")
+                        log.info(
+                            "recvThreadFunc: bt_snoop socket was closed by remote site. stopping.."
+                        )
                         self.exit_requested = True
                         break
-                    record_data += recv_data
+                    record_data += bytearray(recv_data)
                 except socket.timeout:
-                    pass # this is ok. just try again without error
+                    pass  # this is ok. just try again without error
 
             if not record_data or len(record_data) != inc_len:
                 if not self.exit_requested:
                     log.warn("recvThreadFunc: Cannot recv data. stopping.")
                     self.exit_requested = True
                 break
-            
+
             if self.write_btsnooplog:
                 self.btsnooplog_file.write(record_data)
                 self.btsnooplog_file.flush()
@@ -189,9 +238,18 @@ class ADBCore(InternalBlue):
                 parsed_time = None
 
             # Put all relevant infos into a tuple. The HCI packet is parsed with the help of hci.py.
-            record = (hci.parse_hci_packet(record_data), orig_len, inc_len, flags, drops, parsed_time)
+            record = (
+                hci.parse_hci_packet(record_data),
+                orig_len,
+                inc_len,
+                flags,
+                drops,
+                parsed_time,
+            )
 
-            log.debug("_recvThreadFunc Recv: [" + str(parsed_time) + "] " + str(record[0]))
+            log.debug(
+                "_recvThreadFunc Recv: [" + str(parsed_time) + "] " + str(record[0])
+            )
 
             # Put the record into all queues of registeredHciRecvQueues if their
             # filter function matches.
@@ -199,8 +257,10 @@ class ADBCore(InternalBlue):
                 if filter_function == None or filter_function(record):
                     try:
                         queue.put(record, block=False)
-                    except Queue.Full:
-                        log.warn("recvThreadFunc: A recv queue is full. dropping packets..")
+                    except queue2k.Full:
+                        log.warn(
+                            "recvThreadFunc: A recv queue is full. dropping packets.."
+                        )
 
             # Call all callback functions inside registeredHciCallbacks and pass the
             # record as argument.
@@ -209,9 +269,9 @@ class ADBCore(InternalBlue):
 
             # Check if the stackDumpReceiver has noticed that the chip crashed.
             # if self.stackDumpReceiver and self.stackDumpReceiver.stack_dump_has_happend:
-                # A stack dump has happend!
-                # log.warn("recvThreadFunc: The controller sent a stack dump.")
-                # self.exit_requested = True
+            # A stack dump has happend!
+            # log.warn("recvThreadFunc: The controller sent a stack dump.")
+            # self.exit_requested = True
 
         log.debug("Receive Thread terminated.")
 
@@ -227,12 +287,17 @@ class ADBCore(InternalBlue):
         # (with multiple attached Android devices) we must not hard code the
         # forwarded port numbers. Therefore we choose the port numbers
         # randomly and hope that they are not already in use.
-        self.hciport = random.randint(60000, 65534)  # minus 1, as we are using hciport + 1
-        log.debug("_setupSockets: Selected random ports snoop=%d and inject=%d" % (self.hciport, self.hciport + 1))
+        self.hciport = random.randint(
+            60000, 65534
+        )  # minus 1, as we are using hciport + 1
+        log.debug(
+            "_setupSockets: Selected random ports snoop=%d and inject=%d"
+            % (self.hciport, self.hciport + 1)
+        )
 
         # Forward ports 8872 and 8873. Ignore log.info() outputs by the adb function.
         saved_loglevel = context.log_level
-        context.log_level = 'warn'
+        context.log_level = "warn"
         try:
             adb.adb(["forward", "tcp:%d" % (self.hciport), "tcp:8872"])
             adb.adb(["forward", "tcp:%d" % (self.hciport + 1), "tcp:8873"])
@@ -245,7 +310,7 @@ class ADBCore(InternalBlue):
         # Connect to hci injection port
         self.s_inject = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
         try:
-            self.s_inject.connect(('127.0.0.1', self.hciport + 1))
+            self.s_inject.connect(("127.0.0.1", self.hciport + 1))
             self.s_inject.settimeout(0.5)
         except socket.error:
             log.warn("Could not connect to adb. Is your device authorized?")
@@ -253,16 +318,16 @@ class ADBCore(InternalBlue):
 
         # Connect to hci snoop log port
         self.s_snoop = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-        self.s_snoop.connect(('127.0.0.1', self.hciport))
+        self.s_snoop.connect(("127.0.0.1", self.hciport))
         self.s_snoop.settimeout(0.5)
 
         # Read btsnoop header
-        if (self._read_btsnoop_hdr() == None):
+        if self._read_btsnoop_hdr() == None:
             log.warn("Could not read btsnoop header")
             self.s_inject.close()
             self.s_snoop.close()
             self.s_inject = self.s_snoop = None
-            context.log_level = 'warn'
+            context.log_level = "warn"
             adb.adb(["forward", "--remove", "tcp:%d" % (self.hciport)])
             adb.adb(["forward", "--remove", "tcp:%d" % (self.hciport + 1)])
             context.log_level = saved_loglevel
@@ -274,23 +339,25 @@ class ADBCore(InternalBlue):
         Close s_snoop and s_inject sockets. Remove port forwarding with adb.
         """
 
-        if (self.s_inject != None):
+        if self.s_inject != None:
             self.s_inject.close()
             self.s_inject = None
-        if (self.s_snoop != None):
+        if self.s_snoop != None:
             self.s_snoop.close()
             self.s_snoop = None
 
         saved_loglevel = context.log_level
-        context.log_level = 'warn'
-        try:
-            adb.adb(["forward", "--remove", "tcp:%d" % (self.hciport)])
-            adb.adb(["forward", "--remove", "tcp:%d" % (self.hciport + 1)])
-        except PwnlibException as e:
-            log.warn("Removing adb port forwarding failed: " + str(e))
-            return False
-        finally:
-            context.log_level = saved_loglevel
+        context.log_level = "warn"
+        if self.hciport is not None:
+            hciport = self.hciport
+            try:
+                adb.adb(["forward", "--remove", f"tcp:{hciport}"])
+                adb.adb(["forward", "--remove", f"tcp:{hciport + 1}"])
+            except PwnlibException as e:
+                log.warn("Removing adb port forwarding failed: " + str(e))
+                return False
+            finally:
+                context.log_level = saved_loglevel
 
     def _setupSerialSu(self):
         """
@@ -314,36 +381,54 @@ class ADBCore(InternalBlue):
         self.serial = True
 
         saved_loglevel = context.log_level
-        context.log_level = 'warn'
+        context.log_level = "warn"
 
         try:
             # check dependencies
-            if adb.which('su') is None:
+            if adb.which("su") is None:
                 log.critical("su not found, rooted smartphone required!")
                 return False
-           
-            if adb.process(['su', '-c', 'which', 'nc']).recvall() == '':
+
+            if adb.process(["su", "-c", "which", "nc"]).recvall() == "":
                 log.critical("nc not found, install busybox!")
                 return False
 
             # automatically detect the proper serial device with lsof
-            logfile = adb.process(["su", "-c", "lsof | grep btsnoop_hci.log | awk '{print $NF}'"]).recvall().strip()
+            logfile = (
+                adb.process(
+                    ["su", "-c", "lsof | grep btsnoop_hci.log | awk '{print $NF}'"]
+                )
+                .recvall()
+                .strip()
+                .decode("utf-8")
+            )
             log.info("Android btsnoop logfile %s...", logfile)
-            interface = adb.process(["su", "-c", "lsof | grep bluetooth | grep tty | awk '{print $NF}'"]).recvall().strip()
+            interface = (
+                adb.process(
+                    ["su", "-c", "lsof | grep bluetooth | grep tty | awk '{print $NF}'"]
+                )
+                .recvall()
+                .strip()
+                .decode("utf-8")
+            )
             log.info("Android Bluetooth interface %s...", interface)
 
-            if logfile == '':
-                log.critical("Could not find Bluetooth logfile. Enable Bluetooth snoop logging.")
+            if logfile == "":
+                log.critical(
+                    "Could not find Bluetooth logfile. Enable Bluetooth snoop logging."
+                )
                 return False
 
-            if interface == '':
+            if interface == "":
                 log.critical("Could not find Bluetooth interface. Enable Bluetooth.")
                 return False
 
             # spawn processes
-            adb.process(["su", "-c", 'tail -f -n +0 %s | nc -l -p 8872' % logfile])
+            adb.process(["su", "-c", "tail -f -n +0 %s | nc -l -p 8872" % logfile])
             adb.process(["su", "-c", "nc -l -p 8873 >/sdcard/internalblue_input.bin"])
-            adb.process(["su", "-c", "tail -f /sdcard/internalblue_input.bin >>%s" % interface])
+            adb.process(
+                ["su", "-c", "tail -f /sdcard/internalblue_input.bin >>%s" % interface]
+            )
             sleep(2)
 
         except PwnlibException as e:
@@ -353,5 +438,3 @@ class ADBCore(InternalBlue):
             context.log_level = saved_loglevel
 
         return True
-
-

internalblue/cli.py

@@ -28,76 +28,145 @@
 #   Software.
 
 
-from pwn import *
+from __future__ import print_function
+
+import socket
+import sys
+from builtins import str
+import internalblue.utils.pwnlib_wrapper as pwnlib
 import os
 import traceback
 import argparse
 
-from adbcore import ADBCore
-from hcicore import HCICore
+from .adbcore import ADBCore
+from .hcicore import HCICore
 from sys import platform
 
-import cmds
+from . import cmds
+
+try:
+    import typing
+    from typing import List, Optional
+    from internalblue.core import InternalBlue
+    from . import DeviceTuple
+
+except:
+    pass
 
 HISTFILE = "_internalblue.hist"
 
+
 def print_banner():
-    banner = """\
+    banner = r"""
    ____     __                    _____  __
   /  _/__  / /____ _______  ___ _/ / _ )/ /_ _____
  _/ // _ \/ __/ -_) __/ _ \/ _ `/ / _  / / // / -_)
 /___/_//_/\__/\__/_/ /_//_/\_,_/_/____/_/\_,_/\__/
 
-
-type <help> for usage information!\n\n"""
+type <help> for usage information!
+"""
     for line in banner:
-        term.output(text.blue(line))
+        pwnlib.term.output(pwnlib.text.blue(line))
 
-def commandLoop(internalblue):
+
+def commandLoop(internalblue, init_commands=None):
+    cmdstack = init_commands.split(";")[::-1] if init_commands else None
     while internalblue.running and not internalblue.exit_requested:
         cmd_instance = None
         try:
-            cmdline = term.readline.readline(prompt='> ').strip()
-            cmdword = cmdline.split(' ')[0].split('=')[0]
-            if(cmdword == ''):
+            if cmdstack:
+                cmdline = cmdstack.pop().strip()
+            else:
+                cmdline = (
+                    pwnlib.term.readline.readline(prompt="> ").strip().decode("utf-8")
+                )
+            cmdword = cmdline.split(" ")[0].split("=")[0]
+            if cmdword == "":
                 continue
-            log.debug("Command Line: [[" + cmdword + "]] " + cmdline)
+            pwnlib.log.debug("Command Line: [[" + cmdword + "]] " + cmdline)
             matching_cmd = cmds.findCmd(cmdword)
             if matching_cmd == None:
-                log.warn("Command unknown: " + cmdline)
+                pwnlib.log.warn("Command unknown: " + cmdline)
                 continue
             cmd_instance = matching_cmd(cmdline, internalblue)
-
-            if(not cmd_instance.work()):
-                log.warn("Command failed: " + str(cmd_instance))
+            if not cmd_instance.work():
+                pwnlib.log.warn("Command failed: " + str(cmd_instance))
         except ValueError as e:
-            log.warn("commandLoop: ValueError: " + str(e))
-            continue
+            pwnlib.log.warn("commandLoop: ValueError: " + str(e))
+            raise
         except KeyboardInterrupt:
-            if(cmd_instance != None):
+            if cmd_instance != None:
                 cmd_instance.abort_cmd()
             else:
-                log.info("Got Ctrl-C; exiting...")
+                pwnlib.log.info("Got Ctrl-C; exiting...")
                 internalblue.exit_requested = True
                 break
+        except AssertionError as e:
+            raise
+        except socket.error as e:
+            if e.args == (1, "Operation not permitted"):
+                pwnlib.log.critical(
+                    "Received an 'Operation not permitted' socket.error, you might need root for the command '{}'".format(
+                        cmdline
+                    )
+                )
+                pwnlib.log.critical(traceback.format_exc())
         except Exception as e:
-            internalblue.exit_requested = True      # Make sure all threads terminate
-            log.critical("Uncaught exception (%s). Abort." % str(e))
+            internalblue.exit_requested = True  # Make sure all threads terminate
+            pwnlib.log.critical("Uncaught exception (%s). Abort." % str(e))
             print(traceback.format_exc())
-            break
+            raise
         cmd_instance = None
 
 
-# Main Program Start
-def internalblue_cli():
-    print_banner()
+def _parse_argv(argv):
 
     parser = argparse.ArgumentParser()
-    parser.add_argument("--data-directory", "-d", help="Set data directory. Default: ~/.internalblue")
-    parser.add_argument("--verbose", "-v", help="Set log level to DEBUG", action="store_true")
-    parser.add_argument("--ios-device", "-i", help="Tell internalblue to connect to a remote iPhone HCI socket. Specify socket IP address and port (i.e., 172.20.10.1:1234).")
-    parser.add_argument("--serialsu", "-s", help="On ADB, directly try su/serial/busybox scripting, if you do not have a special bluetooth.default.so file.", action="store_true")
-    args = parser.parse_args()
+    parser.add_argument(
+        "--data-directory", "-d", help="Set data directory. Default: ~/.internalblue"
+    )
+    parser.add_argument(
+        "--verbose", "-v", help="Set log level to DEBUG", action="store_true"
+    )
+    parser.add_argument(
+        "--ios-device",
+        "-i",
+        help="Tell internalblue to connect to a remote iPhone HCI socket. Specify socket IP address and port (i.e., 172.20.10.1:1234).",
+    )
+    parser.add_argument(
+        "--serialsu",
+        "-s",
+        help="On ADB, directly try su/serial/busybox scripting, if you do not have a special bluetooth.default.so file.",
+        action="store_true",
+    )
+    parser.add_argument("--trace", help="Trace hci connection")
+    parser.add_argument("--device", help="Specify device/core to be used")
+    parser.add_argument(
+        "--commands",
+        "-c",
+        help="CLI command to run before prompting, seperated by ';' (used for easier testing)",
+    )
+    parser.add_argument(
+        "--replay",
+        help="Intercept and replace every communication with the core with the one in the specified file",
+    )
+    parser.add_argument(
+        "--save", help="Store a trace into the file that can be used with --replay"
+    )
+    return parser.parse_args(argv)
+
+
+
+# Entry point for the `internalblue` command entry point defined in setup.py
+def internalblue_entry_point():
+    print_banner()
+    return internalblue_cli(sys.argv[1:])
+
+# Main Program Start
+def internalblue_cli(argv, args=None):
+    # print_banner()
+
+    args = args or _parse_argv(argv)
 
     if args.data_directory is not None:
         data_directory = args.data_directory
@@ -116,33 +185,108 @@ def internalblue_cli():
     for cmd in cmds.getCmdList():
         for keyword in cmd.keywords:
             cmd_keywords.append(keyword)
-    readline_completer = term.completer.LongestPrefixCompleter(words=cmd_keywords)
-    term.readline.set_completer(readline_completer)
+    readline_completer = pwnlib.term.completer.LongestPrefixCompleter(
+        words=cmd_keywords
+    )
+    pwnlib.term.readline.set_completer(readline_completer)
+
+    if args.trace:
+        from .socket_hooks import hook
+        from internalblue import socket_hooks
+
+        HookClass = getattr(socket_hooks, args.trace)
+        hook(HCICore, HookClass)
+        hook(ADBCore, HookClass)
+    elif args.save:
+        from .socket_hooks import hook, TraceToFileHook
+
+        hook(HCICore, TraceToFileHook, filename=args.save)
+        hook(ADBCore, TraceToFileHook, filename=args.save)
 
     # Initalize cores and get devices
     # As macOS has additional dependencies (objc), only import it here if needed
-    if args.ios_device:
-        from ioscore import iOSCore
-        connection_methods = [iOSCore(args.ios_device, log_level=log_level, data_directory=data_directory)]
-    elif platform == "darwin":
-        from macoscore import macOSCore
-        connection_methods = [
-            macOSCore(log_level=log_level, data_directory=data_directory),
-            ADBCore(log_level=log_level, data_directory=data_directory)]
-    else:
-        connection_methods = [
-            ADBCore(log_level=log_level, data_directory=data_directory, serial=args.serialsu),
-            HCICore(log_level=log_level, data_directory=data_directory)]
+    connection_methods = []  # type: List[InternalBlue]
+    if args.replay:
+        from .socket_hooks import hook, ReplaySocket
+        from .macoscore import macOSCore
 
-    devices = []
+        replay_devices = ["macos_replay", "adb_replay", "hci_replay", "ios_replay"]
+        if args.device == "macos_replay":
+            from .macoscore import macOSCore
+
+            hook(macOSCore, ReplaySocket, filename=args.replay)
+            connection_methods = [
+                macOSCore(
+                    log_level=log_level, data_directory=data_directory, replay=True
+                )
+            ]
+        elif args.device == "hci_replay":
+            hook(HCICore, ReplaySocket, filename=args.replay)
+            connection_methods = [
+                HCICore(log_level=log_level, data_directory=data_directory, replay=True)
+            ]
+        elif args.device == "adb_replay":
+            hook(ADBCore, ReplaySocket, filename=args.replay)
+            connection_methods = [
+                ADBCore(log_level=log_level, data_directory=data_directory, replay=True)
+            ]
+        elif args.device == "ios_replay":
+            raise NotImplementedError("ios replay is not implemented yet")
+        else:
+            raise ValueError(
+                "--device is required with --replay and has to be one of {}".format(
+                    replay_devices
+                )
+            )
+    else:
+        # if /var/run/usbmuxd exists, we can check for iOS devices
+        if os.path.exists("/var/run/usbmuxd"):
+            from .ioscore import iOSCore
+            connection_methods.append(iOSCore(log_level=log_level, data_directory=data_directory))
+
+        if platform == "darwin":
+            try:
+                from .macoscore import macOSCore
+                connection_methods.append(macOSCore(log_level=log_level, data_directory=data_directory, replay=(args.replay and args.device == "mac")))
+            except ImportError:
+                pwnlib.log.warn("Couldn't import macOSCore. Is IOBluetoothExtended.framework installed?")
+            if args.trace:
+                hook(macOSCore, HookClass)
+            elif args.save:
+                hook(macOSCore, TraceToFileHook, filename=args.save)
+        else:
+            connection_methods.append(HCICore(log_level=log_level, data_directory=data_directory))
+    
+        # ADB core can always be used
+        connection_methods.append(
+            ADBCore(
+                log_level=log_level, data_directory=data_directory, serial=args.serialsu
+            ))
+
+    devices = []  # type: List[DeviceTuple]
     for connection_method in connection_methods:
         devices.extend(connection_method.device_list())
 
+    device = None  # type: Optional[DeviceTuple]
     if len(devices) > 0:
-        if len(devices) == 1:
+        if args.replay:
+            # There should only be one device that was created when --replay was passed
+            device = devices[0]
+        elif args.device:
+            matching_devices = [dev for dev in devices if dev[1] == args.device]
+            if len(matching_devices) > 1:
+                pwnlib.log.critical("Found multiple matching devices")
+                exit(-1)
+            elif len(matching_devices) == 1:
+                pwnlib.log.info("Found device is: {}".format(matching_devices[0]))
+                device = matching_devices[0]
+            else:
+                pwnlib.log.critical("No matching devices found")
+                exit(-1)
+        elif len(devices) == 1:
             device = devices[0]
         else:
-            i = options('Please specify device:',  [d[2] for d in devices], 0)
+            i = pwnlib.options("Please specify device:", [d[2] for d in devices], 0)
             device = devices[i]
 
         # Setup device
@@ -151,29 +295,30 @@ def internalblue_cli():
 
         # Restore readline history:
         if os.path.exists(reference.data_directory + "/" + HISTFILE):
-            readline_history = read(reference.data_directory + "/" + HISTFILE)
-            term.readline.history = readline_history.split('\n')
+            readline_history = pwnlib.read(reference.data_directory + "/" + HISTFILE)
+            pwnlib.term.readline.history = readline_history.split(b"\n")
 
         # Connect to device
         if not reference.connect():
-            log.critical("No connection to target device.")
+            pwnlib.log.critical("No connection to target device.")
             exit(-1)
 
         # Enter command loop (runs until user quits)
-        commandLoop(reference)
+        pwnlib.log.info("Starting commandLoop for reference {}".format(reference))
+        commandLoop(reference, init_commands=args.commands)
 
         # shutdown connection
         reference.shutdown()
 
         # Save readline history:
-        f = open(reference.data_directory + "/" + HISTFILE, "w")
-        f.write("\n".join(term.readline.history))
-        f.close()
+        # TODO: - This causes issues, have to fix ASAP
+        # f = open(reference.data_directory + "/" + HISTFILE, "w")
+        # f.write("\n".join(term.readline.history))
+        # f.close()
 
     # Cleanup
-    log.info("Goodbye")
+    pwnlib.log.info("Goodbye")
 
 
 if __name__ == "__main__":
-    internalblue_cli()
-
+    internalblue_cli(sys.argv[1:])

internalblue/fw/__init__.py

@@ -0,0 +1 @@
+from .fw import FirmwareDefinition

internalblue/fw/fw.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
 
 # fw.py
 #
@@ -23,10 +23,83 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
+from builtins import hex
+from builtins import object
+from types import ModuleType
+from typing import List
+
+
+from internalblue import Address
 from pwn import log
 
 
-class Firmware:
+class MemorySection(object):
+    """
+    All firmwares have memory sections that can be RAM, ROM or neither of both.
+    """
+
+    def __init__(self, start_addr, end_addr, is_rom, is_ram):
+        self.start_addr: Address = start_addr
+        self.end_addr: Address = end_addr
+        self.is_rom: bool = is_rom
+        self.is_ram: bool = is_ram
+
+    def size(self) -> int:
+        return self.end_addr - self.start_addr
+
+
+class FirmwareDefinition:
+
+    DEVICE_NAME: Address
+
+    BD_ADDR: Address
+
+    SECTIONS: List[MemorySection]
+    TRACEPOINT_BODY_ASM_SNIPPET: str
+    TRACEPOINT_HOOKS_LOCATION: int
+    TRACEPOINT_RAM_DUMP_PKT_COUNT = None
+
+    CONNECTION_STRUCT_LENGTH: int
+
+    FW_NAME: str
+
+    QUEUE_NAMES: List[str]
+    QUEUE_HEAD: Address
+    BLOC_HEAD: Address
+    SENDLCP_CODE_BASE_ADDRESS: Address
+
+    SENDLCP_ASM_CODE: str
+
+    SENDLMP_CODE_BASE_ADDRESS: Address
+    SENDLMP_ASM_CODE: str
+
+    FUZZLMP_HOOK_ADDRESS: Address
+    FUZZLMP_CODE_BASE_ADDRESS: Address
+    FUZZLMP_ASM_CODE: str
+
+    CONNECTION_LIST_ADDRESS: Address
+    CONNECTION_ARRAY_ADDRESS: Address
+    CONNECTION_MAX: int
+
+    PATCHRAM_VALUE_TABLE_ADDRESS: Address
+    PATCHRAM_TARGET_TABLE_ADDRESS: Address
+    PATCHRAM_ENABLED_BITMAP_ADDRESS: Address
+    PATCHRAM_ALIGNED: bool
+    PATCHRAM_NUMBER_OF_SLOTS: int
+
+    LAUNCH_RAM_PAUSE = None
+
+    READ_MEM_ALIGNED_ASM_LOCATION: Address
+    READ_MEM_ALIGNED_ASM_SNIPPET: str
+
+    TRACEPOINT_HOOK_SIZE = None
+    TRACEPOINT_BODY_ASM_LOCATION: Address
+    TRACEPOINT_HOOK_ASM = None
+
+
+class Firmware(object):
+    firmware: FirmwareDefinition
+
     def __init__(self, version=None, iOS=False):
         """
         Load and initialize the actual firmware add-ons for Nexus 5, Raspi3, etc.
@@ -35,40 +108,53 @@ class Firmware:
         """
 
         self.version = version
-        self.firmware = None
 
         if version:
             # get LMP Subversion
-            log.info("Chip identifier: 0x%04x (%03d.%03d.%03d)" %
-                     (version, version >> 13, (version & 0xf00) >> 8, version & 0xff))
+            log.info(
+                "Chip identifier: 0x%04x (%03d.%03d.%03d)"
+                % (version, version >> 13, (version & 0xF00) >> 8, version & 0xFF)
+            )
 
             try:
                 # Fix for duplicate version number of evaluation board / iPhones
-                if iOS and version==0x420e:
-                    self.firmware = __import__(__name__ + '_' + hex(version) + '_iphone', fromlist=[''])
+                if iOS and version == 0x420E:
+                    self.firmware = self._module_to_firmware_definition(
+                        __import__(
+                            __name__ + "_" + hex(version) + "_iphone", fromlist=[""]
+                        )
+                    )
                     log.info("Using fw_" + hex(version) + "_iphone.py")
                 else:
-                    self.firmware = __import__(__name__ + '_' + hex(version), fromlist=[''])
+                    self.firmware = self._module_to_firmware_definition(
+                        __import__(__name__ + "_" + hex(version), fromlist=[""])
+                    )
                     log.info("Using fw_" + hex(version) + ".py")
             except ImportError:
                 self.firmware = None
                 pass
 
         if not version or not self.firmware:
-            self.firmware = __import__(__name__ + '_default', fromlist=[''])
+            self.firmware = self._module_to_firmware_definition(
+                __import__(__name__ + "_default", fromlist=[""])
+            )
 
         log.info("Loaded firmware information for " + self.firmware.FW_NAME + ".")
 
+    def _module_to_firmware_definition(self, fw: ModuleType) -> FirmwareDefinition:
+        """
+        Wrap existing usages where the module was used and extract the new FirmwareDefinition class
 
-class MemorySection:
-    """
-    All firmwares have memory sections that can be RAM, ROM or neither of both.
-    """
-    def __init__(self, start_addr, end_addr, is_rom, is_ram):
-        self.start_addr = start_addr
-        self.end_addr = end_addr
-        self.is_rom = is_rom
-        self.is_ram = is_ram
+        :param fw:
+        :return:
+        """
+        _types = {
+            name: cls
+            for name, cls in fw.__dict__.items()
+            if isinstance(cls, type)
+            and issubclass(cls, FirmwareDefinition)
+            and not cls is FirmwareDefinition
+        }
 
-    def size(self):
-        return self.end_addr - self.start_addr
+        if len(_types) == 1:
+            return list(_types.values())[0]

internalblue/fw/fw_0x1111.py

@@ -20,138 +20,142 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
-
-# Firmware Infos
-# Samsung S10/S10e/S10+
-FW_NAME = "BCM4375B1"
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
 
-# Device Infos
-DEVICE_NAME = 0x207f2a
-BD_ADDR = 0x2026e2
+class BCM4375B1(FirmwareDefinition):
+    # Firmware Infos
+    # Samsung S10/S10e/S10+
+    FW_NAME = "BCM4375B1"
 
 
-# Memory Sections
-#                          start,    end,           is_rom? is_ram?
-SECTIONS = [ MemorySection(0x00000000, 0x0013ffff,  True,  False),  # Internal ROM
-             MemorySection(0x00160000, 0x0017ffff,  False, True),   # Patches
-             MemorySection(0x00200000, 0x00288000,  False, True),   # Internal Memory Cortex M3
-             MemorySection(0x00300000, 0x0037ffff,  False, True),
-             ]
+    # Device Infos
+    DEVICE_NAME = 0x207F2A
+    BD_ADDR = 0x2026E2
 
-# Patchram
-PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
-PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
-PATCHRAM_VALUE_TABLE_ADDRESS    = 0x160000
-PATCHRAM_NUMBER_OF_SLOTS        = 256
-PATCHRAM_ALIGNED                = False
 
-BLOC_HEAD = 0x20075c
-BLOC_NG = True
+    # Memory Sections
+    #                          start,    end,           is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x00000000, 0x0013FFFF, True, False),  # Internal ROM
+        MemorySection(0x00160000, 0x0017FFFF, False, True),  # Patches
+        MemorySection(0x00200000, 0x00288000, False, True),  # Internal Memory Cortex M3
+        MemorySection(0x00300000, 0x0037FFFF, False, True),
+    ]
 
-# Assembler snippet for tracepoints
-# In contrast to the Nexus 5 patch, we uninstall ourselves automatically and use internal debug functions
-# TODO S10e does no longer have a patch uninstall function... writemem works to remove patches, but copying
-#      Assembly of the original function from an eval board does not work...
-#TRACEPOINT_BODY_ASM_LOCATION = 0x00218300
-#TRACEPOINT_HOOKS_LOCATION = 0x00218500
-#TRACEPOINT_HOOK_SIZE = 40
-TRACEPOINT_HOOK_ASM = """
-        push {r0-r12, lr}       // save all registers on the stack (except sp and pc)
-        ldr  r6, =0x%x          // addTracepoint() injects pc of original tracepoint here
-        mov  r9, %d             // addTracepoint() injects the patchram slot of the hook patch
-        bl   0x%x               // addTracepoint() injects TRACEPOINT_BODY_ASM_LOCATION here
-        pop  {r0-r12, lr}       // restore registers
+    # Patchram
+    PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000
+    PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
+    PATCHRAM_VALUE_TABLE_ADDRESS = 0x160000
+    PATCHRAM_NUMBER_OF_SLOTS = 256
+    PATCHRAM_ALIGNED = False
 
-        // branch back to the original instruction
-        b 0x%x                  // addTracepoint() injects the address of the tracepoint
-"""
+    BLOC_HEAD = 0x20075C
+    BLOC_NG = True
 
-TRACEPOINT_BODY_ASM_SNIPPET = """
+    # Assembler snippet for tracepoints
+    # In contrast to the Nexus 5 patch, we uninstall ourselves automatically and use internal debug functions
+    # TODO S10e does no longer have a patch uninstall function... writemem works to remove patches, but copying
+    #      Assembly of the original function from an eval board does not work...
+    # TRACEPOINT_BODY_ASM_LOCATION = 0x00218300
+    # TRACEPOINT_HOOKS_LOCATION = 0x00218500
+    # TRACEPOINT_HOOK_SIZE = 40
+    TRACEPOINT_HOOK_ASM = """
+            push {r0-r12, lr}       // save all registers on the stack (except sp and pc)
+            ldr  r6, =0x%x          // addTracepoint() injects pc of original tracepoint here
+            mov  r9, %d             // addTracepoint() injects the patchram slot of the hook patch
+            bl   0x%x               // addTracepoint() injects TRACEPOINT_BODY_ASM_LOCATION here
+            pop  {r0-r12, lr}       // restore registers
+    
+            // branch back to the original instruction
+            b 0x%x                  // addTracepoint() injects the address of the tracepoint
+    """
 
-        mov   r8, lr     // save link register in r8
-       
-        b delete_slot
-
-        // dump registers like before
-
-        // save status register in r5
-        mrs  r5, cpsr
-
-        // malloc HCI event buffer
-        mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
-        mov  r1, 76      // buffer size: size of registers (68 bytes) + type and length + 'TRACE_'
-        bl   0x6cfe2     // hci_allocateEventBlockWithLen(0xff, 78) #DONE
-        mov  r4, r0      // save pointer to the buffer in r4
-
-        // append our custom header (the word 'TRACE_') after the event code and event length field
-        add  r0, 2            // write after the length field
-        ldr  r1, =0x43415254  // 'TRAC'
-        str  r1, [r0]
-        add  r0, 4            // advance the pointer.
-        ldr  r1, =0x5f45      // 'E_'
-        strh r1, [r0]
-        add  r0, 2            // advance the pointer. r0 now points to the start of the register values
-
-        // store pc
-        str  r6, [r0]    // r6 still contains the address of the original pc
-        add  r0, 4       // advance the pointer.
-
-        // store sp
-        mov  r1, 56      // 14 saved registers * 4
-        add  r1, sp
-        str  r1, [r0]
-        add  r0, 4       // advance the pointer.
-
-        // store status register
-        str  r5, [r0]
-        add  r0, 4       // advance the pointer.
-
-        // store other registers
-        mov  r1, sp
-        mov  r2, 56
-        bl   0x2774      // memcpy(dst, src, len) #DONE
-
-        // send HCI buffer to the host
-        mov  r0, r4      // r4 still points to the beginning of the HCI buffer
-        bl   0x6cfa8     // hci_sendEvent #DONE
-
-        // restore status register
-        msr  cpsr_f, r5
-        
-        bl 0x6af24       // bthci_event_vs_DBFW_CoreDumpRAMImageEvent #DONE
-
-        // not possible... could not find patch_uninstallPatchEntry(slot) 
-        // -> disable TP by hand, we stored in r9
-        // TODO - does not work??
-        delete_slot:
-        mov r0, #0
-        mov   r1, r0
-        lsl   r0, r0, #0x2
-        ldr   r3, =0x00310404
-        sub.w r0, r0, #0x400
-        add   r3, #0x3c
-        add   r0, r3
-        movw  r2, #0xffff
-        str   r2, [r0, #0x0]
-        ldr   r0,=0x00310404
-        add   r0, #0x2c
-        ldr   r2, [r0,#0x0]
-        mov   r3, #0x1
-        lsl   r3, r1
-        bic   r2, r3
-        str   r2, [r0, #0x0]
-
-        
-        mov  lr, r8      // restore lr from r8
-        bx   lr          // return
-
-    .align
-    patchram:
-    .byte 0x04
-    .byte 0x04
-    .byte 0x31
-    .byte 0x00
-
-"""
+    TRACEPOINT_BODY_ASM_SNIPPET = """
+    
+            mov   r8, lr     // save link register in r8
+           
+            b delete_slot
+    
+            // dump registers like before
+    
+            // save status register in r5
+            mrs  r5, cpsr
+    
+            // malloc HCI event buffer
+            mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
+            mov  r1, 76      // buffer size: size of registers (68 bytes) + type and length + 'TRACE_'
+            bl   0x6cfe2     // hci_allocateEventBlockWithLen(0xff, 78) #DONE
+            mov  r4, r0      // save pointer to the buffer in r4
+    
+            // append our custom header (the word 'TRACE_') after the event code and event length field
+            add  r0, 2            // write after the length field
+            ldr  r1, =0x43415254  // 'TRAC'
+            str  r1, [r0]
+            add  r0, 4            // advance the pointer.
+            ldr  r1, =0x5f45      // 'E_'
+            strh r1, [r0]
+            add  r0, 2            // advance the pointer. r0 now points to the start of the register values
+    
+            // store pc
+            str  r6, [r0]    // r6 still contains the address of the original pc
+            add  r0, 4       // advance the pointer.
+    
+            // store sp
+            mov  r1, 56      // 14 saved registers * 4
+            add  r1, sp
+            str  r1, [r0]
+            add  r0, 4       // advance the pointer.
+    
+            // store status register
+            str  r5, [r0]
+            add  r0, 4       // advance the pointer.
+    
+            // store other registers
+            mov  r1, sp
+            mov  r2, 56
+            bl   0x2774      // memcpy(dst, src, len) #DONE
+    
+            // send HCI buffer to the host
+            mov  r0, r4      // r4 still points to the beginning of the HCI buffer
+            bl   0x6cfa8     // hci_sendEvent #DONE
+    
+            // restore status register
+            msr  cpsr_f, r5
+            
+            bl 0x6af24       // bthci_event_vs_DBFW_CoreDumpRAMImageEvent #DONE
+    
+            // not possible... could not find patch_uninstallPatchEntry(slot) 
+            // -> disable TP by hand, we stored in r9
+            // TODO - does not work??
+            delete_slot:
+            mov r0, #0
+            mov   r1, r0
+            lsl   r0, r0, #0x2
+            ldr   r3, =0x00310404
+            sub.w r0, r0, #0x400
+            add   r3, #0x3c
+            add   r0, r3
+            movw  r2, #0xffff
+            str   r2, [r0, #0x0]
+            ldr   r0,=0x00310404
+            add   r0, #0x2c
+            ldr   r2, [r0,#0x0]
+            mov   r3, #0x1
+            lsl   r3, r1
+            bic   r2, r3
+            str   r2, [r0, #0x0]
+    
+            
+            mov  lr, r8      // restore lr from r8
+            bx   lr          // return
+    
+        .align
+        patchram:
+        .byte 0x04
+        .byte 0x04
+        .byte 0x31
+        .byte 0x00
+    
+    """

internalblue/fw/fw_0x2209.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
 
 # fw_0x6119.py
 #
@@ -25,70 +25,68 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-# Firmware Infos
-# This runs on Rasperry Pi 3
-FW_NAME = "BCM43430A1"
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
-# Device Infos
-DEVICE_NAME = 0x20401C
-BD_ADDR = 0x201C64
 
-# Memory Sections
-class MemorySection:
-    def __init__(self, start_addr, end_addr, is_rom, is_ram):
-        self.start_addr = start_addr
-        self.end_addr = end_addr
-        self.is_rom = is_rom
-        self.is_ram = is_ram
+class BCM43430A1(FirmwareDefinition):
+    # Firmware Infos
+    # This runs on Rasperry Pi 3
+    FW_NAME = "BCM43430A1"
 
-    def size(self):
-        return self.end_addr - self.start_addr
+    # Device Infos
+    DEVICE_NAME = 0x20401C
+    BD_ADDR = 0x201C64
 
-# Memory Sections
-#                          start,    end,      is_rom? is_ram?
-SECTIONS = [ MemorySection(0x0,      0x90000,  True , False),
-             MemorySection(0xd0000,  0xd8000,  False, True ),
-            #MemorySection(0xe0000,  0x1f0000, True , False),
-             MemorySection(0x200000, 0x21ffff, False, True ),
-             MemorySection(0x260000, 0x268000, True , False),
-            #MemorySection(0x280000, 0x2a0000, True , False),
-             MemorySection(0x318000, 0x320000, False, False),
-             MemorySection(0x324000, 0x360000, False, False),
-             MemorySection(0x362000, 0x362100, False, False),
-             MemorySection(0x363000, 0x363100, False, False),
-             MemorySection(0x600000, 0x600800, False, False),
-             MemorySection(0x640000, 0x640800, False, False),
-             MemorySection(0x650000, 0x650800, False, False),
-            #MemorySection(0x680000, 0x800000, False, False)
-            ]
+    # Memory Sections
+    #                          start,    end,      is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x0, 0x90000, True, False),
+        MemorySection(0xD0000, 0xD8000, False, True),
+        # MemorySection(0xe0000,  0x1f0000, True , False),
+        MemorySection(0x200000, 0x21FFFF, False, True),
+        # MemorySection(0x260000, 0x268000, True , False),  # might crash? issue 14
+        # MemorySection(0x280000, 0x2a0000, True , False),
+        MemorySection(0x318000, 0x320000, False, False),
+        MemorySection(0x324000, 0x360000, False, False),
+        MemorySection(0x362000, 0x362100, False, False),
+        MemorySection(0x363000, 0x363100, False, False),
+        MemorySection(0x600000, 0x600800, False, False),
+        MemorySection(0x640000, 0x640800, False, False),
+        MemorySection(0x650000, 0x650800, False, False),
+        # MemorySection(0x680000, 0x800000, False, False)
+    ]
 
-# Connection Structure and Table
-#CONNECTION_LIST_ADDRESS = 0x204ba8
-CONNECTION_MAX           = 11
-CONNECTION_STRUCT_LENGTH = 0x150  # TODO
+    # Connection Structure and Table
+    # CONNECTION_LIST_ADDRESS = 0x204ba8
+    CONNECTION_MAX = 11
+    CONNECTION_STRUCT_LENGTH = 0x150  # TODO
 
-# Patchram
-PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
-PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
-PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
-PATCHRAM_NUMBER_OF_SLOTS        = 128
-PATCHRAM_ALIGNED                = False
+    # Patchram
+    PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
+    PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000
+    PATCHRAM_VALUE_TABLE_ADDRESS = 0xD0000
+    PATCHRAM_NUMBER_OF_SLOTS = 128
+    PATCHRAM_ALIGNED = False
 
-# Snippet for sendLcpPacket()
-SENDLCP_CODE_BASE_ADDRESS = 0x21a000
-SENDLCP_ASM_CODE = """
-        push {r4,lr}
-
-        // we want to call lmulp_sendLcp(conn_index, input, length)
-
-        mov r0,  %d     // connection index, starts at 0
-        ldr r1, =payload
-        mov r2, %d      // length
-        bl  0x8389A     // lmulp_sendLcp
-
-        pop {r4,pc}     // go back
-
-        .align          // The payload (LMP packet) must be 4-byte aligend (memcpy needs aligned addresses)
-        payload:        // Note: the payload will be appended here by the sendLmpPacket() function
-        """
+    # Heap
+    BLOC_HEAD = 0x200588  # g_dynamic_memory_GeneralUsePools
+    BLOC_NG = True  # Next Generation Bloc Buffer
 
+    # Snippet for sendLcpPacket()
+    SENDLCP_CODE_BASE_ADDRESS = 0x21A000
+    SENDLCP_ASM_CODE = """
+            push {r4,lr}
+    
+            // we want to call lmulp_sendLcp(conn_index, input, length)
+    
+            mov r0,  %d     // connection index, starts at 0
+            ldr r1, =payload
+            mov r2, %d      // length
+            bl  0x8389A     // lmulp_sendLcp
+    
+            pop {r4,pc}     // go back
+    
+            .align          // The payload (LMP packet) must be 4-byte aligend (memcpy needs aligned addresses)
+            payload:        // Note: the payload will be appended here by the sendLmpPacket() function
+            """

internalblue/fw/fw_0x220b.py

@@ -20,26 +20,27 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
-
-# Firmware Infos
-# Evaluation Kit CYW20706
-FW_NAME = "CYW20706"
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
 
-# Memory Sections
-#                          start,    end,           is_rom? is_ram?
-SECTIONS = [ MemorySection(0x00000000, 0x000c7fff,  True,  False),  # Internal ROM
-             MemorySection(0x000d0000, 0x000dffff,  False, True ),
-             MemorySection(0x00200000, 0x00247fff,  False, True),   # Internal Memory Cortex M3
-             ]
-
-# Patchram
-#PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
-#PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
-#PATCHRAM_VALUE_TABLE_ADDRESS    = 0x0d0000
-#PATCHRAM_NUMBER_OF_SLOTS        = 256
-PATCHRAM_ALIGNED                = True
-# only seems to work 4-byte aligned here ...
+class CYW20706(FirmwareDefinition):
+    # Firmware Infos
+    # Evaluation Kit CYW20706
+    FW_NAME = "CYW20706"
 
+    # Memory Sections
+    #                          start,    end,           is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x00000000, 0x000C7FFF, True, False),  # Internal ROM
+        MemorySection(0x000D0000, 0x000DFFFF, False, True),
+        MemorySection(0x00200000, 0x00247FFF, False, True),  # Internal Memory Cortex M3
+    ]
 
+    # Patchram
+    # PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
+    # PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
+    # PATCHRAM_VALUE_TABLE_ADDRESS    = 0x0d0000
+    # PATCHRAM_NUMBER_OF_SLOTS        = 256
+    PATCHRAM_ALIGNED = True
+    # only seems to work 4-byte aligned here ...

internalblue/fw/fw_0x220c.py

@@ -20,27 +20,30 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
-# Firmware Infos
-# Evaluation Kit CYW920819
-FW_NAME = "CYW20819A1"
+class CYW20819A1(FirmwareDefinition):
+    # Firmware Infos
+    # Evaluation Kit CYW920819
+    FW_NAME = "CYW20819A1"
 
 
-# Memory Sections
-#                          start,    end,           is_rom? is_ram?
-SECTIONS = [ MemorySection(0x00000000, 0x001fffff,  True,  False),  # Internal ROM
-             MemorySection(0x00200000, 0x0024ffff,  False, True),   # Internal Memory Cortex M3
-             MemorySection(0x00270000, 0x0027ffff,  False, True),   # Internal Memory Patchram Contents
-             MemorySection(0x00310000, 0x00321fff,  False, True),   # HW Regs Cortex M3 (readable)
-             ]
-
-# Patchram
-PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
-PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
-PATCHRAM_VALUE_TABLE_ADDRESS    = 0x270000
-PATCHRAM_NUMBER_OF_SLOTS        = 256
-PATCHRAM_ALIGNED                = False
-# only seems to work 4-byte aligned here ...
-
+    # Memory Sections
+    #                          start,    end,           is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x00000000, 0x001FFFFF, True, False),  # Internal ROM
+        MemorySection(0x00200000, 0x0024FFFF, False, True),  # Internal Memory Cortex M3
+        MemorySection(
+            0x00270000, 0x0027FFFF, False, True
+        ),  # Internal Memory Patchram Contents
+        MemorySection(0x00310000, 0x00321FFF, False, True),  # HW Regs Cortex M3 (readable)
+    ]
 
+    # Patchram
+    PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000
+    PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
+    PATCHRAM_VALUE_TABLE_ADDRESS = 0x270000
+    PATCHRAM_NUMBER_OF_SLOTS = 256
+    PATCHRAM_ALIGNED = False
+    # only seems to work 4-byte aligned here ...

internalblue/fw/fw_0x220e.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
 #
 # fw_0x220e.py
 #
@@ -23,19 +23,22 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection, FirmwareDefinition
+from __future__ import absolute_import
 
-# Firmware Infos
-FW_NAME = "BCM20702A1 (USB Bluetooth dongle)"
 
-# Device Infos
-#DEVICE_NAME = 0x280CD0                  # rm_deviceLocalName, FIXME has no longer a length byte prepended
-#BD_ADDR = 0x280CA4                      # rm_deviceBDAddr
+class BCM20702A1(FirmwareDefinition):
+    # Firmware Infos
+    FW_NAME = "BCM20702A1"  # (USB Bluetooth dongle)
 
-# Memory Sections
-#                          start,    end,           is_rom? is_ram?
-SECTIONS = [   MemorySection(0x00000000, 0x5ffff,  True,  False),  # Internal ROM
-               MemorySection(0x80000, 0x9bfff,  False,  True),  # Internal RAM
-            ]
-BLOC_HEAD = 0x3166c
+    # Device Infos
+    # DEVICE_NAME = 0x280CD0                  # rm_deviceLocalName, FIXME has no longer a length byte prepended
+    # BD_ADDR = 0x280CA4                      # rm_deviceBDAddr
 
+    # Memory Sections
+    #                          start,    end,           is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x00000000, 0x5FFFF, True, False),  # Internal ROM
+        MemorySection(0x80000, 0x9BFFF, False, True),  # Internal RAM
+    ]
+    BLOC_HEAD = 0x3166C

internalblue/fw/fw_0x2230.py

@@ -1,9 +1,5 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
 
-# fw_default.py
-#
-# Generic firmware file in case we do not know something...
-#
 # Copyright (c) 2019 Jiska Classen. (MIT License)
 #
 # Permission is hereby granted, free of charge, to any person obtaining a copy of
@@ -22,26 +18,30 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
-# Firmware Infos
-FW_NAME = "BCM20703A2 (MacBook Pro 2016)"
 
-# Symbols contained in:
-#   ./WICED-Studio-6.2/20706-A2_Bluetooth/Wiced-BT/BLD_ROM/A_20703A2/20703.symdefs
-#   ./WICED-Studio-6.2/20706-A2_Bluetooth/Wiced-BT/tier2/brcm/wiced_uart/bld/A_20703A2/20703_ram_ext.lst
+class BCM20703A2(FirmwareDefinition):
+    # Firmware Infos
+    FW_NAME = "BCM20703A2 (MacBook Pro 2016)"
 
-# Memory Sections
-#                          start,    end,      is_rom? is_ram?
-SECTIONS = [ MemorySection(0x0,      0xc7fff,  True, False), #0x000c0a97
-             MemorySection(0xd0000,  0xe0000,  False, False), #0x000dd78c
-             MemorySection(0x200000, 0x240000, False, True ), #0x00217a38
-             MemorySection(0x260000, 0x268fff, True, False), #0x0026841d
-             MemorySection(0x318000, 0x320000, False, False),
-             MemorySection(0x324000, 0x338000, False, False),
-             MemorySection(0x362000, 0x362100, False, False),
-             MemorySection(0x363000, 0x363100, False, False),
-             MemorySection(0x600000, 0x600800, False, False),
-             MemorySection(0x640000, 0x640800, False, False),
-             MemorySection(0x650000, 0x650800, False, False)
-            ]
+    # Symbols contained in:
+    #   ./WICED-Studio-6.2/20706-A2_Bluetooth/Wiced-BT/BLD_ROM/A_20703A2/20703.symdefs
+    #   ./WICED-Studio-6.2/20706-A2_Bluetooth/Wiced-BT/tier2/brcm/wiced_uart/bld/A_20703A2/20703_ram_ext.lst
+
+    # Memory Sections
+    #                          start,    end,      is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x0, 0xC7FFF, True, False),  # 0x000c0a97
+        MemorySection(0xD0000, 0xE0000, False, False),  # 0x000dd78c
+        MemorySection(0x200000, 0x240000, False, True),  # 0x00217a38
+        MemorySection(0x260000, 0x268FFF, True, False),  # 0x0026841d
+        MemorySection(0x318000, 0x320000, False, False),
+        MemorySection(0x324000, 0x338000, False, False),
+        MemorySection(0x362000, 0x362100, False, False),
+        MemorySection(0x363000, 0x363100, False, False),
+        MemorySection(0x600000, 0x600800, False, False),
+        MemorySection(0x640000, 0x640800, False, False),
+        MemorySection(0x650000, 0x650800, False, False),
+    ]

internalblue/fw/fw_0x240f.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
 
 # fw.py
 #
@@ -25,145 +25,145 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
-
-# Firmware Infos
-# This runs on Nexus 6P, Samsung Galaxy S6, Samsung Galaxy S6 edge
-FW_NAME = "BCM4358A3"
-
-# Device Infos
-DEVICE_NAME = 0x213994  # [type: 1byte] [len: 1byte] [name: len byte] #works
-BD_ADDR = 0x201C48 #works
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
 
-# Memory Sections
-#                          start,    end,      is_rom? is_ram?
-SECTIONS = [ MemorySection(0x0,      0x9ef00,  True , False),
-             MemorySection(0xd0000,  0xd8000,  False, True ), # Patchram values with actual code / hooks
-            #MemorySection(0xe0000,  0x1e0000, True , False), # all zero
-             MemorySection(0x200000, 0x22a000, False, True ),
-             MemorySection(0x260000, 0x268000, True , False),
-            #MemorySection(0x280000, 0x2a0000, True , False), # all zero
-             MemorySection(0x300000, 0x301000, False, False),
-             MemorySection(0x310000, 0x318000, False, True ), # Patchram addresses
-             MemorySection(0x318000, 0x322000, False, False),
-             MemorySection(0x324000, 0x368000, False, False),
-             MemorySection(0x600000, 0x600800, False, False),
-             MemorySection(0x640000, 0x640800, False, False),
-             MemorySection(0x650000, 0x650800, False, False),
-            #MemorySection(0x680000, 0x800000, False, False)
-             #MemorySection(0x770000, 0x78ffff, False, False), #TODO maybe more, but all zero
-            ]
+class BCM4358A3(FirmwareDefinition):
+    # Firmware Infos
+    # This runs on Nexus 6P, Samsung Galaxy S6, Samsung Galaxy S6 edge
+    FW_NAME = "BCM4358A3"
+
+    # Device Infos
+    DEVICE_NAME = 0x213994  # [type: 1byte] [len: 1byte] [name: len byte] #works
+    BD_ADDR = 0x201C48  # works
+
+    # Memory Sections
+    #                          start,    end,      is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x0, 0x9EF00, True, False),
+        MemorySection(
+            0xD0000, 0xD8000, False, True
+        ),  # Patchram values with actual code / hooks
+        # MemorySection(0xe0000,  0x1e0000, True , False), # all zero
+        MemorySection(0x200000, 0x22A000, False, True),
+        MemorySection(0x260000, 0x268000, True, False),
+        # MemorySection(0x280000, 0x2a0000, True , False), # all zero
+        MemorySection(0x300000, 0x301000, False, False),
+        MemorySection(0x310000, 0x318000, False, True),  # Patchram addresses
+        MemorySection(0x318000, 0x322000, False, False),
+        MemorySection(0x324000, 0x368000, False, False),
+        MemorySection(0x600000, 0x600800, False, False),
+        MemorySection(0x640000, 0x640800, False, False),
+        MemorySection(0x650000, 0x650800, False, False),
+        # MemorySection(0x680000, 0x800000, False, False)
+        # MemorySection(0x770000, 0x78ffff, False, False), #TODO maybe more, but all zero
+    ]
+
+    # Connection Struct and Table
+
+    # Nexus 6P works differently:
+    # address 0x21AD5C holds a list with pointers to connection structs!
+    # CONNECTION_ARRAY_ADDRESS = 0x21ad88 #potentially the first valid address... but not part of an array
+    # CONNECTION_ARRAY_SIZE    = 11 #is still 11 for Nexus 6P, but no longer hard-coded
+    CONNECTION_LIST_ADDRESS = 0x21AD5C
+    CONNECTION_MAX = 11
+    CONNECTION_STRUCT_LENGTH = 0x168  # ??
+
+    # Patchram
+    PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
+    PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000
+    PATCHRAM_VALUE_TABLE_ADDRESS = 0xD0000
+    PATCHRAM_NUMBER_OF_SLOTS = 192
+    PATCHRAM_ALIGNED = False  # we can use standard ReadRAM HCI on Nexus 6P
+
+    LAUNCH_RAM_PAUSE = 8  # bugfix: pause between multiple readMemAligned() calls in seconds
+    # not a problem: doing multiple writeMem in a row
+    # the thing that crashes: executing multiple launchRam() in a row: sendhcicmd 0xfc4e 0x473CC
+    # crashes even when executing 0x5E860 twice, which is just a nullsub
+    # also crashes during the pause if there are other hci events
+
+    # Snippet for sendLmpPacket()
+    SENDLMP_CODE_BASE_ADDRESS = 0xD5130
+    # TODO already works except for correct mac address - so still a problem with the connection #
+    SENDLMP_ASM_CODE = """
+            push {r4,lr}
+
+            // malloc buffer for LMP packet
+            bl 0x3AAA8      // malloc_0x20_bloc_buffer_memzero
+            mov r4, r0      // store buffer for LMP packet inside r4
+
+            // fill buffer
+            add r0, 0xC         // The actual LMP packet must start at offset 0xC in the buffer.
+                                // The first 12 bytes are (supposely?) unused and remain zero.
+            ldr r1, =payload    // LMP packet is stored at the end of the snippet
+            mov r2, 20          // Max. size of an LMP packet is 19 (I guess). The send_LMP_packet
+                                // function will use the LMP opcode to lookup the actual size and
+                                // use it for actually transmitting the correct number of bytes.
+            bl  0x63900+1       // memcpy
+
+            // load conn struct pointer (needed for determine if we are master or slave)
+            mov r0, %d      // connection number is injected by sendLmpPacket()
+            bl 0x473CC      // find connection struct from conn nr (r0 will hold pointer to conn struct)    //FIXME
+            //FIXME: mac address is always 1f:8d:00:00:00:00
+
+            // set tid bit if we are the slave
+            ldr r1, [r0, 0x1c]  // Load a bitmap from the connection struct into r1.
+            lsr r1, 15          // The 'we are master'-bit is at position 15 of this bitmap
+            eor r1, 0x1         // invert and isolate the bit to get the correct value for the TID bit
+            and r1, 0x1
+            ldr r2, [r4, 0xC]   // Load the LMP opcode into r2. Note: The opcode was already shifted
+                                // left by 1 bit (done by sendLmpPacket()). The TID bit goes into
+                                // the LSB (least significant bit) of this shifted opcode byte.
+            orr r2, r1          // insert the TID bit into the byte
+            str r2, [r4, 0xC]   // Store the byte back into the LMP packet buffer
 
 
-# Connection Struct and Table
+            // send LMP packet
+            mov r1, r4      // load the address of the LMP packet buffer into r1.
+                            // r0 still contains the connection number.
+            pop {r4,lr}     // restore r4 and the lr
+            b 0xAF4C        // branch to send_LMP_packet. send_LMP_packet will do the return for us.
 
-# Nexus 6P works differently:
-# address 0x21AD5C holds a list with pointers to connection structs!
-# CONNECTION_ARRAY_ADDRESS = 0x21ad88 #potentially the first valid address... but not part of an array
-# CONNECTION_ARRAY_SIZE    = 11 #is still 11 for Nexus 6P, but no longer hard-coded
-CONNECTION_LIST_ADDRESS   = 0x21AD5C
-CONNECTION_MAX            = 11
-CONNECTION_STRUCT_LENGTH  = 0x168 #??
+            .align          // The payload (LMP packet) must be 4-byte aligend (memcpy needs aligned addresses)
+            payload:        // Note: the payload will be appended here by the sendLmpPacket() function
+            """
 
-# Patchram
-PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
-PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
-PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
-PATCHRAM_NUMBER_OF_SLOTS        = 192
-PATCHRAM_ALIGNED                = False #we can use standard ReadRAM HCI on Nexus 6P  
+    # Assembler snippet for the readMemAligned() function
+    READ_MEM_ALIGNED_ASM_LOCATION = 0xD5030
+    READ_MEM_ALIGNED_ASM_SNIPPET = """
+            push {r4, lr}
 
+            // malloc HCI event buffer
+            mov  r1, 0xff    // event code is 0xff (vendor specific HCI Event) 
+            mov  r2, %d      // readMemAligned() injects the number of bytes it wants to read here 
+            add  r2, 4       // + 'READ'
+            mov  r0, r2
+            adds r0, #2      // r0 needs to be 2 higher than r2 in all malloc_hci_event_buffer calls
+            bl   0x22C4      // malloc_hci_event_buffer (will automatically copy event code and length into the buffer)
+            mov  r4, r0      // save pointer to the buffer in r4
 
-LAUNCH_RAM_PAUSE = 8 # bugfix: pause between multiple readMemAligned() calls in seconds
-# not a problem: doing multiple writeMem in a row
-# the thing that crashes: executing multiple launchRam() in a row: sendhcicmd 0xfc4e 0x473CC
-# crashes even when executing 0x5E860 twice, which is just a nullsub
-# also crashes during the pause if there are other hci events
+            // append our custom header (the word 'READ') after the event code and event length field
+            add  r0, 10      // write after the length field (offset 10 in event struct)
+            ldr  r1, =0x44414552  // 'READ'
+            str  r1, [r0]
+            add  r0, 4      // advance the pointer. r0 now points to the beginning of our read data
 
+            // copy data to buffer
+            ldr  r1, =0x%x  // readMemAligned() injects the read_address here. r1 will be used as src pointer in the loop
+            mov  r2, %d     // readMemAligned() injects the number of dwords to read here. r2 will be the loop counter
+        loop:
+            ldr  r3, [r1]   // read 4 bytes from the read_address
+            str  r3, [r0]   // store them inside the HCI buffer
+            add  r0, 4      // advance the buffer pointer
+            add  r1, 4      // advance the read_address
+            subs r2, 1      // decrement the loop variable
+            bne  loop       // branch if r2 is not zero yet
 
-# Snippet for sendLmpPacket()
-SENDLMP_CODE_BASE_ADDRESS = 0xd5130
-#TODO already works except for correct mac address - so still a problem with the connection #
-SENDLMP_ASM_CODE = """
-        push {r4,lr}
+            // send HCI buffer to the host
+            mov r0, r4      // r4 still points to the beginning of the HCI buffer
 
-        // malloc buffer for LMP packet
-        bl 0x3AAA8      // malloc_0x20_bloc_buffer_memzero
-        mov r4, r0      // store buffer for LMP packet inside r4
+            pop {r4, lr}    // return
+            b   0x20F4      // send_hci_event()
 
-        // fill buffer
-        add r0, 0xC         // The actual LMP packet must start at offset 0xC in the buffer.
-                            // The first 12 bytes are (supposely?) unused and remain zero.
-        ldr r1, =payload    // LMP packet is stored at the end of the snippet
-        mov r2, 20          // Max. size of an LMP packet is 19 (I guess). The send_LMP_packet
-                            // function will use the LMP opcode to lookup the actual size and
-                            // use it for actually transmitting the correct number of bytes.
-        bl  0x63900+1       // memcpy
-
-        // load conn struct pointer (needed for determine if we are master or slave)
-        mov r0, %d      // connection number is injected by sendLmpPacket()
-        bl 0x473CC      // find connection struct from conn nr (r0 will hold pointer to conn struct)    //FIXME
-        //FIXME: mac address is always 1f:8d:00:00:00:00
-
-        // set tid bit if we are the slave
-        ldr r1, [r0, 0x1c]  // Load a bitmap from the connection struct into r1.
-        lsr r1, 15          // The 'we are master'-bit is at position 15 of this bitmap
-        eor r1, 0x1         // invert and isolate the bit to get the correct value for the TID bit
-        and r1, 0x1
-        ldr r2, [r4, 0xC]   // Load the LMP opcode into r2. Note: The opcode was already shifted
-                            // left by 1 bit (done by sendLmpPacket()). The TID bit goes into
-                            // the LSB (least significant bit) of this shifted opcode byte.
-        orr r2, r1          // insert the TID bit into the byte
-        str r2, [r4, 0xC]   // Store the byte back into the LMP packet buffer
-
-
-        // send LMP packet
-        mov r1, r4      // load the address of the LMP packet buffer into r1.
-                        // r0 still contains the connection number.
-        pop {r4,lr}     // restore r4 and the lr
-        b 0xAF4C        // branch to send_LMP_packet. send_LMP_packet will do the return for us.
-
-        .align          // The payload (LMP packet) must be 4-byte aligend (memcpy needs aligned addresses)
-        payload:        // Note: the payload will be appended here by the sendLmpPacket() function
         """
-
-# Assembler snippet for the readMemAligned() function
-READ_MEM_ALIGNED_ASM_LOCATION = 0xd5030 
-READ_MEM_ALIGNED_ASM_SNIPPET = """
-        push {r4, lr}
-        
-        // malloc HCI event buffer
-        mov  r1, 0xff    // event code is 0xff (vendor specific HCI Event) 
-        mov  r2, %d      // readMemAligned() injects the number of bytes it wants to read here 
-        add  r2, 4       // + 'READ'
-        mov  r0, r2
-        adds r0, #2      // r0 needs to be 2 higher than r2 in all malloc_hci_event_buffer calls
-        bl   0x22C4      // malloc_hci_event_buffer (will automatically copy event code and length into the buffer)
-        mov  r4, r0      // save pointer to the buffer in r4
-
-        // append our custom header (the word 'READ') after the event code and event length field
-        add  r0, 10      // write after the length field (offset 10 in event struct)
-        ldr  r1, =0x44414552  // 'READ'
-        str  r1, [r0]
-        add  r0, 4      // advance the pointer. r0 now points to the beginning of our read data
-
-        // copy data to buffer
-        ldr  r1, =0x%x  // readMemAligned() injects the read_address here. r1 will be used as src pointer in the loop
-        mov  r2, %d     // readMemAligned() injects the number of dwords to read here. r2 will be the loop counter
-    loop:
-        ldr  r3, [r1]   // read 4 bytes from the read_address
-        str  r3, [r0]   // store them inside the HCI buffer
-        add  r0, 4      // advance the buffer pointer
-        add  r1, 4      // advance the read_address
-        subs r2, 1      // decrement the loop variable
-        bne  loop       // branch if r2 is not zero yet
-
-        // send HCI buffer to the host
-        mov r0, r4      // r4 still points to the beginning of the HCI buffer
-
-        pop {r4, lr}    // return
-        b   0x20F4      // send_hci_event()
-
-    """
-
-

internalblue/fw/fw_0x4109.py

@@ -20,64 +20,70 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
-
-# Firmware Infos
-# iPhone 6
-FW_NAME = "BCM4345B0"
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
 
-# Memory Sections
-#                          start,    end,           is_rom? is_ram?
-SECTIONS = [ MemorySection(0x00000000, 0x000c07ff,  True,  False),  # Internal ROM
-             MemorySection(0x000d0000, 0x000dffff,  False, True),   # Internal Memory Patchram Contents
-             MemorySection(0x00200400, 0x00201cff,  False, True),   # Internal Memory Cortex M3
-             ]
-
-# Patchram
-PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000  # needs to be aligned read
-PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
-PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
-PATCHRAM_NUMBER_OF_SLOTS        = 128
-PATCHRAM_ALIGNED                = True
+class BCM4345B0(FirmwareDefinition):
+    # Firmware Infos
+    # iPhone 6
+    FW_NAME = "BCM4345B0"
 
 
-# Assembler snippet for the readMemAligned() function
-READ_MEM_ALIGNED_ASM_LOCATION = 0x215000  # there is nothing free until 0xdffff, but 0x215000 looks okay during runtime
-READ_MEM_ALIGNED_ASM_SNIPPET = """
-        push {r4, lr}
+    # Memory Sections
+    #                          start,    end,           is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x00000000, 0x000C07FF, True, False),  # Internal ROM
+        MemorySection(
+            0x000D0000, 0x000DFFFF, False, True
+        ),  # Internal Memory Patchram Contents
+        MemorySection(0x00200400, 0x00201CFF, False, True),  # Internal Memory Cortex M3
+    ]
 
-        // malloc HCI event buffer
-        mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
-        mov  r1, %d      // readMemAligned() injects the number of bytes it wants to read here
-        add  r1, 6       // + type and length + 'READ'
-        bl   0x15DD4      // hci_sendEvent (will automatically copy event code and length into the buffer)
-        mov  r4, r0      // save pointer to the buffer in r4
+    # Patchram
+    PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000  # needs to be aligned read
+    PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
+    PATCHRAM_VALUE_TABLE_ADDRESS = 0xD0000
+    PATCHRAM_NUMBER_OF_SLOTS = 128
+    PATCHRAM_ALIGNED = True
 
-        // append our custom header (the word 'READ') after the event code and event length field
-        add  r0, 2            // write after the length field
-        ldr  r1, =0x44414552  // 'READ'
-        str  r1, [r0]
-        add  r0, 4            // advance the pointer. r0 now points to the beginning of our read data
 
-        // copy data to buffer
-        ldr  r1, =0x%x  // readMemAligned() injects the read_address here. r1 will be used as src pointer in the loop
-        mov  r2, %d     // readMemAligned() injects the number of dwords to read here. r2 will be the loop counter
-    loop:
-        ldr  r3, [r1]   // read 4 bytes from the read_address
-        str  r3, [r0]   // store them inside the HCI buffer
-        add  r0, 4      // advance the buffer pointer
-        add  r1, 4      // advance the read_address
-        subs r2, 1      // decrement the loop variable
-        bne  loop       // branch if r2 is not zero yet
-
-        // send HCI buffer to the host
-        mov r0, r4      // r4 still points to the beginning of the HCI buffer
-        bl  0x573B8     // send_hci_event_without_free()
-
-        // free HCI buffer
-        mov r0, r4
-        bl  0x581AE     // osapi_blockPoolFree
-
-        pop {r4, pc}    // return
-     """
+    # Assembler snippet for the readMemAligned() function
+    READ_MEM_ALIGNED_ASM_LOCATION = 0x215000  # there is nothing free until 0xdffff, but 0x215000 looks okay during runtime
+    READ_MEM_ALIGNED_ASM_SNIPPET = """
+            push {r4, lr}
+    
+            // malloc HCI event buffer
+            mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
+            mov  r1, %d      // readMemAligned() injects the number of bytes it wants to read here
+            add  r1, 6       // + type and length + 'READ'
+            bl   0x15DD4      // hci_sendEvent (will automatically copy event code and length into the buffer)
+            mov  r4, r0      // save pointer to the buffer in r4
+    
+            // append our custom header (the word 'READ') after the event code and event length field
+            add  r0, 2            // write after the length field
+            ldr  r1, =0x44414552  // 'READ'
+            str  r1, [r0]
+            add  r0, 4            // advance the pointer. r0 now points to the beginning of our read data
+    
+            // copy data to buffer
+            ldr  r1, =0x%x  // readMemAligned() injects the read_address here. r1 will be used as src pointer in the loop
+            mov  r2, %d     // readMemAligned() injects the number of dwords to read here. r2 will be the loop counter
+        loop:
+            ldr  r3, [r1]   // read 4 bytes from the read_address
+            str  r3, [r0]   // store them inside the HCI buffer
+            add  r0, 4      // advance the buffer pointer
+            add  r1, 4      // advance the read_address
+            subs r2, 1      // decrement the loop variable
+            bne  loop       // branch if r2 is not zero yet
+    
+            // send HCI buffer to the host
+            mov r0, r4      // r4 still points to the beginning of the HCI buffer
+            bl  0x573B8     // send_hci_event_without_free()
+    
+            // free HCI buffer
+            mov r0, r4
+            bl  0x581AE     // osapi_blockPoolFree
+    
+            pop {r4, pc}    // return
+         """

internalblue/fw/fw_0x411a.py

@@ -20,28 +20,34 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
-
-# Firmware Infos
-# Samsung Galaxy S8
-FW_NAME = "BCM4347B0"
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
 
-# Memory Sections
-#                          start,    end,           is_rom? is_ram?
-SECTIONS = [ MemorySection(0x00000000, 0x00100000,  True,  False),  # Internal ROM
-             MemorySection(0x00130000, 0x00150000,  False, True),   # Internal Memory Patchram Contents
-             MemorySection(0x00200000, 0x0023ffff,  False, True),   # Internal Memory Cortex M3
-             ]
-
-# Patchram
-PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
-PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
-PATCHRAM_VALUE_TABLE_ADDRESS    = 0x130000
-PATCHRAM_NUMBER_OF_SLOTS        = 256
-PATCHRAM_ALIGNED                = False
+class BCM4347B0(FirmwareDefinition):
+    # Firmware Infos
+    # Samsung Galaxy S8
+    FW_NAME = "BCM4347B0"
 
 
-# Heap
-BLOC_HEAD = 0x20067C                    # g_dynamic_memory_GeneralUsePools
-BLOC_NG = True                          # Next Generation Bloc Buffer
+    # Memory Sections
+    #                          start,    end,           is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x00000000, 0x00100000, True, False),  # Internal ROM
+        MemorySection(
+            0x00130000, 0x00150000, False, True
+        ),  # Internal Memory Patchram Contents
+        MemorySection(0x00200000, 0x0023FFFF, False, True),  # Internal Memory Cortex M3
+    ]
+
+    # Patchram
+    PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000
+    PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
+    PATCHRAM_VALUE_TABLE_ADDRESS = 0x130000
+    PATCHRAM_NUMBER_OF_SLOTS = 256
+    PATCHRAM_ALIGNED = False
+
+
+    # Heap
+    BLOC_HEAD = 0x20067C  # g_dynamic_memory_GeneralUsePools
+    BLOC_NG = True  # Next Generation Bloc Buffer

internalblue/fw/fw_0x4196.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
 #
 # fw_0x220e.py
 #
@@ -23,19 +23,19 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection
 
 # Firmware Infos
 FW_NAME = "BCM20702A2"
 
 # Device Infos
-#DEVICE_NAME = 0x280CD0                  # rm_deviceLocalName, FIXME has no longer a length byte prepended
-#BD_ADDR = 0x280CA4                      # rm_deviceBDAddr
+# DEVICE_NAME = 0x280CD0                  # rm_deviceLocalName, FIXME has no longer a length byte prepended
+# BD_ADDR = 0x280CA4                      # rm_deviceBDAddr
 
 # Memory Sections
 #                          start,    end,           is_rom? is_ram?
-SECTIONS = [   MemorySection(0x00000000, 0x5ffff,  True,  False),  # Internal ROM
-               MemorySection(0x80000, 0x9bfff,  False,  True),  # Internal RAM
-            ]
-BLOC_HEAD = 0x3166c
-
+SECTIONS = [
+    MemorySection(0x00000000, 0x5FFFF, True, False),  # Internal ROM
+    MemorySection(0x80000, 0x9BFFF, False, True),  # Internal RAM
+]
+BLOC_HEAD = 0x3166C

internalblue/fw/fw_0x4208.py

@@ -20,202 +20,217 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
-
-# Firmware Infos
-# Evaluation Kit CYW920735
-FW_NAME = "CYW20735B1"
-
-# Device Infos
-DEVICE_NAME = 0x280CD0                  # rm_deviceLocalName, FIXME has no longer a length byte prepended
-BD_ADDR = 0x280CA4                      # rm_deviceBDAddr
-
-#Heap
-BLOC_HEAD = 0x200474                    # g_dynamic_memory_GeneralUsePools
-BLOC_NG = True                          # Next Generation Bloc Buffer
-
-# Memory Sections
-#                          start,    end,           is_rom? is_ram?
-SECTIONS = [ MemorySection(0x00000000, 0x001fffff,  True,  False),  # Internal ROM
-             MemorySection(0x00200000, 0x0024ffff,  False, True),   # Internal Memory Cortex M3
-             MemorySection(0x00270000, 0x0027ffff,  False, True),   # Internal Memory Patchram Contents
-             MemorySection(0x00280000, 0x00283fff,  False, True),   # ToRam
-             MemorySection(0x00300000, 0x00307fff,  False, True),   # HW Regs Cortex M3 (readable)
-             MemorySection(0x00310000, 0x00321fff,  False, True),   # HW Regs Cortex M3 (readable)
-             MemorySection(0x00326000, 0x0032ffff,  False, True),   # HW Regs Cortex M3 (readable)
-             MemorySection(0x00338000, 0x00367fff,  False, True),   # HW Regs Cortex M3 (readable) + Pka Top
-             MemorySection(0x00370000, 0x0037ffff,  False, True),   # RTX FIFO
-             MemorySection(0x00390000, 0x00397fff,  False, True),   # Power WD
-             #MemorySection(0x00404000, 0x00407fff,  False, True),   # EF Registers (seem to be sometimes unavailable)
-             MemorySection(0x00410000, 0x00413fff,  False, True),   # BT Modem Registers
-             MemorySection(0x00420000, 0x00423fff,  False, True),   # FM Modem Registers
-             MemorySection(0x00430000, 0x00433fff,  False, True),   # MAC 15.4
-             MemorySection(0x00440000, 0x00443fff,  False, True),   # SecEng Top
-             MemorySection(0x00450000, 0x00453fff,  False, True),   # Capscan Top
-             MemorySection(0x00500000, 0x006007ff,  False, True),   # EPM RAM (readable) + RF Regs
-             MemorySection(0x00640000, 0x006407ff,  False, True),   # CLB Regs
-             MemorySection(0x00650000, 0x006507ff,  False, True),   # GCI Regs
-             MemorySection(0x20000000, 0x2024ffff,  False, True),   # SRAM
-             MemorySection(0x20270000, 0x20283fff,  False, True),   # SRAM
-             MemorySection(0x20500000, 0x200fffff,  False, True),   # SRAM
-             MemorySection(0x22000000, 0x2226ffff,  False, True),   # SRAM Bits?
-
-             MemorySection(0x40000000, 0x40003fff,  False, True),   # ToRam Alias / Peripherals
-             MemorySection(0x42000000, 0x4207ffff,  False, True),   # ToRam Bits
-             #MemorySection(0x60000000, 0x60000000,  False, True),   # Extern BlueRF SRAM (range TBD)
-             #MemorySection(0xa0000000, 0xa0000000,  False, True),   # Extern Device Address (range TBD)
-             MemorySection(0xe0000000, 0xe0100000,  False, True),   # Base PPB Address
-            ]
-
-# Patchram
-PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
-PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
-PATCHRAM_VALUE_TABLE_ADDRESS    = 0x270000
-PATCHRAM_NUMBER_OF_SLOTS        = 192
-PATCHRAM_ALIGNED                = False
-# only seems to work 4-byte aligned here ...
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
 
-# Connection Struct and Table
-CONNECTION_LIST_ADDRESS   = 0x216F98    # pRm_whole_conn = 0x280C9C points to this
-CONNECTION_MAX            = 11          # g_bt_max_connections = 0 in firmware
-CONNECTION_STRUCT_LENGTH  = 0x168       # ??
+class CYW20735B1(FirmwareDefinition):
+    # Firmware Infos
+    # Evaluation Kit CYW920735
+    FW_NAME = "CYW20735B1"
 
-# Snippet for fuzzLmp()
-FUZZLMP_HOOK_ADDRESS = 0xB08D8          # execute standard SendLmpPdu HCI to fill parameters
-FUZZLMP_CODE_BASE_ADDRESS = 0x271A00    # memory area of other WICED patches
-FUZZLMP_ASM_CODE = """
-        // This hook is put into the end of bthci_cmd_vs_SendLmpPdu_B08AC,
-        // so command parsing is still performed as normal. We jump in
-        // before bthci_cmd_vs_SendLmpPdu pops and calls DHM_LMPTx.
+    # Device Infos
+    DEVICE_NAME = (
+        0x280CD0  # rm_deviceLocalName, FIXME has no longer a length byte prepended
+    )
+    BD_ADDR = 0x280CA4  # rm_deviceBDAddr
 
-        mov r0, r6 // 4 byte alignment
+    # Heap
+    BLOC_HEAD = 0x200474  # g_dynamic_memory_GeneralUsePools
+    BLOC_NG = True  # Next Generation Bloc Buffer
 
-        // put length argument into table_entry
-        // payload[5] holds the size argument
-        ldr   r5, =table_entry
-        add   r5, #4         // length offset within table entry
-        ldrb r6, [r4, #5]    // size is in position r4+5
-        strb r6, [r5]        
+    # Memory Sections
+    #                          start,    end,           is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x00000000, 0x001FFFFF, True, False),  # Internal ROM
+        MemorySection(0x00200000, 0x0024FFFF, False, True),  # Internal Memory Cortex M3
+        MemorySection(
+            0x00270000, 0x0027FFFF, False, True
+        ),  # Internal Memory Patchram Contents
+        MemorySection(0x00280000, 0x00283FFF, False, True),  # ToRam
+        MemorySection(
+            0x00300000, 0x00307FFF, False, True
+        ),  # HW Regs Cortex M3 (readable)
+        MemorySection(
+            0x00310000, 0x00321FFF, False, True
+        ),  # HW Regs Cortex M3 (readable)
+        MemorySection(
+            0x00326000, 0x0032FFFF, False, True
+        ),  # HW Regs Cortex M3 (readable)
+        MemorySection(
+            0x00338000, 0x00367FFF, False, True
+        ),  # HW Regs Cortex M3 (readable) + Pka Top
+        MemorySection(0x00370000, 0x0037FFFF, False, True),  # RTX FIFO
+        MemorySection(0x00390000, 0x00397FFF, False, True),  # Power WD
+        # MemorySection(0x00404000, 0x00407fff,  False, True),   # EF Registers (seem to be sometimes unavailable)
+        MemorySection(0x00410000, 0x00413FFF, False, True),  # BT Modem Registers
+        MemorySection(0x00420000, 0x00423FFF, False, True),  # FM Modem Registers
+        MemorySection(0x00430000, 0x00433FFF, False, True),  # MAC 15.4
+        MemorySection(0x00440000, 0x00443FFF, False, True),  # SecEng Top
+        MemorySection(0x00450000, 0x00453FFF, False, True),  # Capscan Top
+        MemorySection(
+            0x00500000, 0x006007FF, False, True
+        ),  # EPM RAM (readable) + RF Regs
+        MemorySection(0x00640000, 0x006407FF, False, True),  # CLB Regs
+        MemorySection(0x00650000, 0x006507FF, False, True),  # GCI Regs
+        MemorySection(0x20000000, 0x2024FFFF, False, True),  # SRAM
+        MemorySection(0x20270000, 0x20283FFF, False, True),  # SRAM
+        MemorySection(0x20500000, 0x200FFFFF, False, True),  # SRAM
+        MemorySection(0x22000000, 0x2226FFFF, False, True),  # SRAM Bits?
+        MemorySection(0x40000000, 0x40003FFF, False, True),  # ToRam Alias / Peripherals
+        MemorySection(0x42000000, 0x4207FFFF, False, True),  # ToRam Bits
+        # MemorySection(0x60000000, 0x60000000,  False, True),   # Extern BlueRF SRAM (range TBD)
+        # MemorySection(0xa0000000, 0xa0000000,  False, True),   # Extern Device Address (range TBD)
+        MemorySection(0xE0000000, 0xE0100000, False, True),  # Base PPB Address
+    ]
 
-        // we need to do the original pop...
-        pop  {r4-r6, lr}
+    # Patchram
+    PATCHRAM_TARGET_TABLE_ADDRESS = Address(0x310000)
+    PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
+    PATCHRAM_VALUE_TABLE_ADDRESS = 0x270000
+    PATCHRAM_NUMBER_OF_SLOTS = 192
+    PATCHRAM_ALIGNED = False
+    # only seems to work 4-byte aligned here ...
 
-        // now we simply continue like the original DHM_LMPTx_3453E function
-        cmp   r1, #0
-        itt   eq
-        moveq r0, #4
-        bxeq  lr
-        push  {r4-r10, lr}   // code at 0x34546
-        mov   r7, r0
+    # Connection Struct and Table
+    CONNECTION_LIST_ADDRESS = 0x216F98  # pRm_whole_conn = 0x280C9C points to this
+    CONNECTION_MAX = 11  # g_bt_max_connections = 0 in firmware
+    CONNECTION_STRUCT_LENGTH = 0x168  # ??
 
-        // part of the check if hook_LMP_TxFilter is installed
-        ldr   r0, =0x203144 //dhmAvLinkAutoDetectEnable
-        mov   r4, r1
-        ldr   r2, [r0, #12]
-        //cbz   r2, loc_34564
+    # Snippet for fuzzLmp()
+    FUZZLMP_HOOK_ADDRESS = 0xB08D8  # execute standard SendLmpPdu HCI to fill parameters
+    FUZZLMP_CODE_BASE_ADDRESS = 0x271A00  # memory area of other WICED patches
+    FUZZLMP_ASM_CODE = """
+            // This hook is put into the end of bthci_cmd_vs_SendLmpPdu_B08AC,
+            // so command parsing is still performed as normal. We jump in
+            // before bthci_cmd_vs_SendLmpPdu pops and calls DHM_LMPTx.
+    
+            mov r0, r6 // 4 byte alignment
+    
+            // put length argument into table_entry
+            // payload[5] holds the size argument
+            ldr   r5, =table_entry
+            add   r5, #4         // length offset within table entry
+            ldrb r6, [r4, #5]    // size is in position r4+5
+            strb r6, [r5]        
+    
+            // we need to do the original pop...
+            pop  {r4-r6, lr}
+    
+            // now we simply continue like the original DHM_LMPTx_3453E function
+            cmp   r1, #0
+            itt   eq
+            moveq r0, #4
+            bxeq  lr
+            push  {r4-r10, lr}   // code at 0x34546
+            mov   r7, r0
+    
+            // part of the check if hook_LMP_TxFilter is installed
+            ldr   r0, =0x203144 //dhmAvLinkAutoDetectEnable
+            mov   r4, r1
+            ldr   r2, [r0, #12]
+            //cbz   r2, loc_34564
+    
+            ldr.w r8, [r7]         // code at 0x34564
+            mov   r0, r8
+            bl    0x93E60        // rm_getDHMAclPtr
+            movs  r5, r0
+            // skip check if we actually got a ptr 
+            // continue at 0x3457A
+            ldrb  r0, [r4, #12]
+            tst.w r0, #0xfe     // test for extended op ...
+            add.w r0, r3, #0xc
+            
+    
+            // now we regularily would call the opcode conversion table function
+            // however, we do not use lm_getLmpInfoType_86A82 but insert our own table here        
+            ldr    r1, =table_entry // table_ptr with exactly one entry, so no offsets included here
+            ldr    r0, =table_entry
+    
+            // branch back to DHM_LMPTx position after bl lm_getLmpInfoType
+            b     0x3458A
+    
+            .align
+            table_entry:
+                .byte 0x40 //lm_LmpUnsupportedPdu
+                .byte 0x6A 
+                .byte 0x08
+                .byte 0x00
+                .byte 0x20  //length, will be overwritten by us anyways, but can not be longer than one buffer (0x20)  
+                .byte 0x00    
+                .byte 0x00
+                .byte 0x00
+            """
 
-        ldr.w r8, [r7]         // code at 0x34564
-        mov   r0, r8
-        bl    0x93E60        // rm_getDHMAclPtr
-        movs  r5, r0
-        // skip check if we actually got a ptr 
-        // continue at 0x3457A
-        ldrb  r0, [r4, #12]
-        tst.w r0, #0xfe     // test for extended op ...
-        add.w r0, r3, #0xc
-        
+    # Assembler snippet for tracepoints
+    # In contrast to the Nexus 5 patch, we uninstall ourselves automatically and use internal debug functions
+    TRACEPOINT_BODY_ASM_LOCATION = 0x00218500
+    TRACEPOINT_HOOKS_LOCATION = 0x00218700
+    TRACEPOINT_HOOK_SIZE = 40
+    TRACEPOINT_HOOK_ASM = """
+            push {r0-r12, lr}       // save all registers on the stack (except sp and pc)
+            ldr  r6, =0x%x          // addTracepoint() injects pc of original tracepoint here
+            mov  r0, %d             // addTracepoint() injects the patchram slot of the hook patch
+            bl   0x28794            // patch_uninstallPatchEntry(slot)
+            bl   0x%x               // addTracepoint() injects TRACEPOINT_BODY_ASM_LOCATION here
+            pop  {r0-r12, lr}       // restore registers
+    
+            // branch back to the original instruction
+            b 0x%x                  // addTracepoint() injects the address of the tracepoint
+    """
 
-        // now we regularily would call the opcode conversion table function
-        // however, we do not use lm_getLmpInfoType_86A82 but insert our own table here        
-        ldr    r1, =table_entry // table_ptr with exactly one entry, so no offsets included here
-        ldr    r0, =table_entry
-
-        // branch back to DHM_LMPTx position after bl lm_getLmpInfoType
-        b     0x3458A
-
-        .align
-        table_entry:
-            .byte 0x40 //lm_LmpUnsupportedPdu
-            .byte 0x6A 
-            .byte 0x08
-            .byte 0x00
-            .byte 0x20  //length, will be overwritten by us anyways, but can not be longer than one buffer (0x20)  
-            .byte 0x00    
-            .byte 0x00
-            .byte 0x00
-        """
-
-
-# Assembler snippet for tracepoints
-# In contrast to the Nexus 5 patch, we uninstall ourselves automatically and use internal debug functions
-TRACEPOINT_BODY_ASM_LOCATION = 0x00218500
-TRACEPOINT_HOOKS_LOCATION = 0x00218700
-TRACEPOINT_HOOK_SIZE = 40
-TRACEPOINT_HOOK_ASM = """
-        push {r0-r12, lr}       // save all registers on the stack (except sp and pc)
-        ldr  r6, =0x%x          // addTracepoint() injects pc of original tracepoint here
-        mov  r0, %d             // addTracepoint() injects the patchram slot of the hook patch
-        bl   0x28794            // patch_uninstallPatchEntry(slot)
-        bl   0x%x               // addTracepoint() injects TRACEPOINT_BODY_ASM_LOCATION here
-        pop  {r0-r12, lr}       // restore registers
-
-        // branch back to the original instruction
-        b 0x%x                  // addTracepoint() injects the address of the tracepoint
-"""
-
-TRACEPOINT_BODY_ASM_SNIPPET = """
-        mov   r8, lr     // save link register in r8
-        
-        // dump registers like before
-
-        // save status register in r5
-        mrs  r5, cpsr
-
-        // malloc HCI event buffer
-        mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
-        mov  r1, 76      // buffer size: size of registers (68 bytes) + type and length + 'TRACE_'
-        bl   0x2DEF4     // hci_allocateEventBlockWithLen(0xff, 78)
-        mov  r4, r0      // save pointer to the buffer in r4
-
-        // append our custom header (the word 'TRACE_') after the event code and event length field
-        add  r0, 2            // write after the length field
-        ldr  r1, =0x43415254  // 'TRAC'
-        str  r1, [r0]
-        add  r0, 4            // advance the pointer.
-        ldr  r1, =0x5f45      // 'E_'
-        strh r1, [r0]
-        add  r0, 2            // advance the pointer. r0 now points to the start of the register values
-
-        // store pc
-        str  r6, [r0]    // r6 still contains the address of the original pc
-        add  r0, 4       // advance the pointer.
-
-        // store sp
-        mov  r1, 56      // 14 saved registers * 4
-        add  r1, sp
-        str  r1, [r0]
-        add  r0, 4       // advance the pointer.
-
-        // store status register
-        str  r5, [r0]
-        add  r0, 4       // advance the pointer.
-
-        // store other registers
-        mov  r1, sp
-        mov  r2, 56
-        bl   0xEAB4   // memcpy(dst, src, len)
-
-        // send HCI buffer to the host
-        mov  r0, r4      // r4 still points to the beginning of the HCI buffer
-        bl   0x2DEC0     // hci_sendEvent
-
-        // restore status register
-        msr  cpsr_f, r5
-        
-        bl 0x26C7A       // bthci_event_vs_DBFW_CoreDumpRAMImageEvent
-
-        mov  lr, r8      // restore lr from r8
-        bx   lr          // return
-        
-"""
+    TRACEPOINT_BODY_ASM_SNIPPET = """
+            mov   r8, lr     // save link register in r8
+            
+            // dump registers like before
+    
+            // save status register in r5
+            mrs  r5, cpsr
+    
+            // malloc HCI event buffer
+            mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
+            mov  r1, 76      // buffer size: size of registers (68 bytes) + type and length + 'TRACE_'
+            bl   0x2DEF4     // hci_allocateEventBlockWithLen(0xff, 78)
+            mov  r4, r0      // save pointer to the buffer in r4
+    
+            // append our custom header (the word 'TRACE_') after the event code and event length field
+            add  r0, 2            // write after the length field
+            ldr  r1, =0x43415254  // 'TRAC'
+            str  r1, [r0]
+            add  r0, 4            // advance the pointer.
+            ldr  r1, =0x5f45      // 'E_'
+            strh r1, [r0]
+            add  r0, 2            // advance the pointer. r0 now points to the start of the register values
+    
+            // store pc
+            str  r6, [r0]    // r6 still contains the address of the original pc
+            add  r0, 4       // advance the pointer.
+    
+            // store sp
+            mov  r1, 56      // 14 saved registers * 4
+            add  r1, sp
+            str  r1, [r0]
+            add  r0, 4       // advance the pointer.
+    
+            // store status register
+            str  r5, [r0]
+            add  r0, 4       // advance the pointer.
+    
+            // store other registers
+            mov  r1, sp
+            mov  r2, 56
+            bl   0xEAB4   // memcpy(dst, src, len)
+    
+            // send HCI buffer to the host
+            mov  r0, r4      // r4 still points to the beginning of the HCI buffer
+            bl   0x2DEC0     // hci_sendEvent
+    
+            // restore status register
+            msr  cpsr_f, r5
+            
+            bl 0x26C7A       // bthci_event_vs_DBFW_CoreDumpRAMImageEvent
+    
+            mov  lr, r8      // restore lr from r8
+            bx   lr          // return
+            
+    """

internalblue/fw/fw_0x420e.py

@@ -20,109 +20,114 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
-
-# Firmware Infos
-# Evaluation Kit CYW927019
-FW_NAME = "CYW27039B1 (NOT iPhone X/XR!)"
-# TODO this is not the iPhone firmware, we need to add a switch in fw.py
-
-# Device Infos
-DEVICE_NAME = 0x280CD0                  # rm_deviceLocalName, FIXME has no longer a length byte prepended
-BD_ADDR = 0x280CA4                      # rm_deviceBDAddr
-
-#Heap
-BLOC_HEAD = 0x0200c7c                   # g_dynamic_memory_GeneralUsePools
-BLOC_NG = True                          # Next Generation Bloc Buffer
-
-# Memory Sections
-#                          start,    end,           is_rom? is_ram?
-SECTIONS = [ MemorySection(0x00000000, 0x001fffff,  True,  False),  # Internal ROM
-             MemorySection(0x00200000, 0x0024ffff,  False, True),   # Internal Memory Cortex M3
-             MemorySection(0x00270000, 0x0027ffff,  False, True),   # Internal Memory Patchram Contents
-             MemorySection(0x00280000, 0x00283fff,  False, True),   # ToRam
-            ]
-
-# Patchram
-PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
-PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
-PATCHRAM_VALUE_TABLE_ADDRESS    = 0x270000
-PATCHRAM_NUMBER_OF_SLOTS        = 256
-PATCHRAM_ALIGNED                = False
-# only seems to work 4-byte aligned here ...
+from .fw import MemorySection, FirmwareDefinition
+from __future__ import absolute_import
 
 
-# Assembler snippet for tracepoints
-# In contrast to the Nexus 5 patch, we uninstall ourselves automatically and use internal debug functions
-TRACEPOINT_BODY_ASM_LOCATION = 0x00223100
-TRACEPOINT_HOOKS_LOCATION = 0x00223200
-TRACEPOINT_HOOK_SIZE = 40
-TRACEPOINT_HOOK_ASM = """
-        push {r0-r12, lr}       // save all registers on the stack (except sp and pc)
-        ldr  r6, =0x%x          // addTracepoint() injects pc of original tracepoint here
-        mov  r0, %d             // addTracepoint() injects the patchram slot of the hook patch
-        bl   0x34964            // patch_uninstallPatchEntry(slot)
-        bl   0x%x               // addTracepoint() injects TRACEPOINT_BODY_ASM_LOCATION here
-        pop  {r0-r12, lr}       // restore registers
+class CYW20739B1(FirmwareDefinition):
+    # Firmware Infos
+    # Evaluation Kit CYW920719
+    FW_NAME = "CYW20739B1 (NOT iPhone X/XR!)"
+    # TODO this is not the iPhone firmware, we need to add a switch in fw.py
 
-        // branch back to the original instruction
-        b 0x%x                  // addTracepoint() injects the address of the tracepoint
-"""
+    # Device Infos
+    DEVICE_NAME = (
+        0x280CD0  # rm_deviceLocalName, FIXME has no longer a length byte prepended
+    )
+    BD_ADDR = 0x280CA4  # rm_deviceBDAddr
 
-TRACEPOINT_BODY_ASM_SNIPPET = """
-        mov   r8, lr     // save link register in r8
+    # Heap
+    BLOC_HEAD = 0x0200C7C  # g_dynamic_memory_GeneralUsePools
+    BLOC_NG = True  # Next Generation Bloc Buffer
 
-        // dump registers like before
+    # Memory Sections
+    #                          start,    end,           is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x00000000, 0x001FFFFF, True, False),  # Internal ROM
+        MemorySection(0x00200000, 0x0024FFFF, False, True),  # Internal Memory Cortex M3
+        MemorySection(
+            0x00270000, 0x0027FFFF, False, True
+        ),  # Internal Memory Patchram Contents
+        MemorySection(0x00280000, 0x00283FFF, False, True),  # ToRam
+    ]
 
-        // save status register in r5
-        mrs  r5, cpsr
-
-        // malloc HCI event buffer
-        mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
-        mov  r1, 76      // buffer size: size of registers (68 bytes) + type and length + 'TRACE_'
-        bl   0xF7B6      // hci_allocateEventBlockWithLen(0xff, 78)
-        mov  r4, r0      // save pointer to the buffer in r4
-
-        // append our custom header (the word 'TRACE_') after the event code and event length field
-        add  r0, 2            // write after the length field
-        ldr  r1, =0x43415254  // 'TRAC'
-        str  r1, [r0]
-        add  r0, 4            // advance the pointer.
-        ldr  r1, =0x5f45      // 'E_'
-        strh r1, [r0]
-        add  r0, 2            // advance the pointer. r0 now points to the start of the register values
-
-        // store pc
-        str  r6, [r0]    // r6 still contains the address of the original pc
-        add  r0, 4       // advance the pointer.
-
-        // store sp
-        mov  r1, 56      // 14 saved registers * 4
-        add  r1, sp
-        str  r1, [r0]
-        add  r0, 4       // advance the pointer.
-
-        // store status register
-        str  r5, [r0]
-        add  r0, 4       // advance the pointer.
-
-        // store other registers
-        mov  r1, sp
-        mov  r2, 56
-        bl   0xAF0BC     // memcpy(dst, src, len)
-
-        // send HCI buffer to the host
-        mov  r0, r4      // r4 still points to the beginning of the HCI buffer
-        bl   0xF782      // hci_sendEvent
-
-        // restore status register
-        msr  cpsr_f, r5
-
-        bl 0x2D702       // bthci_event_vs_DBFW_CoreDumpRAMImageEvent
-
-        mov  lr, r8      // restore lr from r8
-        bx   lr          // return
-
-"""
+    # Patchram
+    PATCHRAM_TARGET_TABLE_ADDRESS = Address(0x310000)
+    PATCHRAM_ENABLED_BITMAP_ADDRESS = Address(0x310404)
+    PATCHRAM_VALUE_TABLE_ADDRESS = Address(0x270000)
+    PATCHRAM_NUMBER_OF_SLOTS = 256
+    PATCHRAM_ALIGNED = False
+    # only seems to work 4-byte aligned here ...
 
+    # Assembler snippet for tracepoints
+    # In contrast to the Nexus 5 patch, we uninstall ourselves automatically and use internal debug functions
+    TRACEPOINT_BODY_ASM_LOCATION = 0x00223100
+    TRACEPOINT_HOOKS_LOCATION = 0x00223200
+    TRACEPOINT_HOOK_SIZE = 40
+    TRACEPOINT_HOOK_ASM = """
+            push {r0-r12, lr}       // save all registers on the stack (except sp and pc)
+            ldr  r6, =0x%x          // addTracepoint() injects pc of original tracepoint here
+            mov  r0, %d             // addTracepoint() injects the patchram slot of the hook patch
+            bl   0x34964            // patch_uninstallPatchEntry(slot)
+            bl   0x%x               // addTracepoint() injects TRACEPOINT_BODY_ASM_LOCATION here
+            pop  {r0-r12, lr}       // restore registers
+    
+            // branch back to the original instruction
+            b 0x%x                  // addTracepoint() injects the address of the tracepoint
+    """
 
+    TRACEPOINT_BODY_ASM_SNIPPET = """
+            mov   r8, lr     // save link register in r8
+    
+            // dump registers like before
+    
+            // save status register in r5
+            mrs  r5, cpsr
+    
+            // malloc HCI event buffer
+            mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
+            mov  r1, 76      // buffer size: size of registers (68 bytes) + type and length + 'TRACE_'
+            bl   0xF7B6      // hci_allocateEventBlockWithLen(0xff, 78)
+            mov  r4, r0      // save pointer to the buffer in r4
+    
+            // append our custom header (the word 'TRACE_') after the event code and event length field
+            add  r0, 2            // write after the length field
+            ldr  r1, =0x43415254  // 'TRAC'
+            str  r1, [r0]
+            add  r0, 4            // advance the pointer.
+            ldr  r1, =0x5f45      // 'E_'
+            strh r1, [r0]
+            add  r0, 2            // advance the pointer. r0 now points to the start of the register values
+    
+            // store pc
+            str  r6, [r0]    // r6 still contains the address of the original pc
+            add  r0, 4       // advance the pointer.
+    
+            // store sp
+            mov  r1, 56      // 14 saved registers * 4
+            add  r1, sp
+            str  r1, [r0]
+            add  r0, 4       // advance the pointer.
+    
+            // store status register
+            str  r5, [r0]
+            add  r0, 4       // advance the pointer.
+    
+            // store other registers
+            mov  r1, sp
+            mov  r2, 56
+            bl   0xAF0BC     // memcpy(dst, src, len)
+    
+            // send HCI buffer to the host
+            mov  r0, r4      // r4 still points to the beginning of the HCI buffer
+            bl   0xF782      // hci_sendEvent
+    
+            // restore status register
+            msr  cpsr_f, r5
+    
+            bl 0x2D702       // bthci_event_vs_DBFW_CoreDumpRAMImageEvent
+    
+            mov  lr, r8      // restore lr from r8
+            bx   lr          // return
+    
+    """

internalblue/fw/fw_0x420e_iphone.py

@@ -20,22 +20,28 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection, FirmwareDefinition
+from __future__ import absolute_import
 
-# Firmware Infos
-# iPhone 8/X/XR
-FW_NAME = "BCM4347B1"
 
-# Memory Sections
-#                          start,    end,           is_rom? is_ram?
-SECTIONS = [ MemorySection(0x00000000, 0x00103fff,  True,  False),  # Internal ROM
-             MemorySection(0x00130000, 0x0014ffff,  False, True),   # Internal Memory Patchram Contents
-             MemorySection(0x00200000, 0x0024ffff,  False, True),   # Internal Memory Cortex M3
-            ]
+class BCM4347B1(FirmwareDefinition):
+    # Firmware Infos
+    # iPhone 8/X/XR
+    FW_NAME = "BCM4347B1"
 
-# Patchram
-PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
-PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
-PATCHRAM_VALUE_TABLE_ADDRESS    = 0x130000
-PATCHRAM_NUMBER_OF_SLOTS        = 256
-PATCHRAM_ALIGNED                = False
+    # Memory Sections
+    #                          start,    end,           is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x00000000, 0x00103FFF, True, False),  # Internal ROM
+        MemorySection(
+            0x00130000, 0x0014FFFF, False, True
+        ),  # Internal Memory Patchram Contents
+        MemorySection(0x00200000, 0x0024FFFF, False, True),  # Internal Memory Cortex M3
+    ]
+
+    # Patchram
+    PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000
+    PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
+    PATCHRAM_VALUE_TABLE_ADDRESS = 0x130000
+    PATCHRAM_NUMBER_OF_SLOTS = 256
+    PATCHRAM_ALIGNED = False

internalblue/fw/fw_0x422a.py

@@ -1,6 +1,6 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
 
-# MacBook 15" early 2011 tested with Ubuntu 
+# MacBook 15" early 2011 tested with Ubuntu
 #
 # Generic firmware file in case we do not know something...
 #
@@ -22,16 +22,19 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection, FirmwareDefinition
 
-# Firmware Infos
-FW_NAME = "BCM2070B0 (MacBook Pro 2011)"
-# Build date: Jul 9 2008
 
-# Memory Sections
-#                          start,    end,      is_rom? is_ram?
-SECTIONS = [ MemorySection(0x0,      0x58000,  True , False),
-             MemorySection(0x80000,  0x9b000,  False, True ),
-           ]
+class BCM2070B0(FirmwareDefinition):
+    # Firmware Infos
+    FW_NAME = "BCM2070B0 (MacBook Pro 2011)"
+    # Build date: Jul 9 2008
 
-BLOC_HEAD = 0x88518
+    # Memory Sections
+    #                          start,    end,      is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x0, 0x58000, True, False),
+        MemorySection(0x80000, 0x9B000, False, True),
+    ]
+
+    BLOC_HEAD = 0x88518

internalblue/fw/fw_0x6103.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
 
 # fw_0x6103.py
 #
@@ -20,35 +20,39 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
-# Firmware Infos
-# This runs on an iPhone 7
-FW_NAME = "BCM4355C0"
 
-# Device Infos
-DEVICE_NAME = 0x204c60
+class BCM4355C0(FirmwareDefinition):
+    # Firmware Infos
+    # This runs on an iPhone 7
+    FW_NAME = "BCM4355C0"
 
-# Memory Sections
-#                          start,    end,      is_rom? is_ram?
-SECTIONS = [ MemorySection(0x0,      0x90000,  True , False),
-             MemorySection(0xd0000,  0xd8000,  False, True ),
-            #MemorySection(0xe0000,  0x1f0000, True , False),
-             MemorySection(0x200000, 0x228000, False, True ),
-             MemorySection(0x260000, 0x268000, True , False),
-            #MemorySection(0x280000, 0x2a0000, True , False),
-             MemorySection(0x318000, 0x320000, False, False),
-             MemorySection(0x324000, 0x360000, False, False),
-             MemorySection(0x362000, 0x362100, False, False),
-             MemorySection(0x363000, 0x363100, False, False),
-             MemorySection(0x600000, 0x600800, False, False),
-             MemorySection(0x640000, 0x640800, False, False),
-             MemorySection(0x650000, 0x650800, False, False),
-            #MemorySection(0x680000, 0x800000, False, False)
-            ]
+    # Device Infos
+    DEVICE_NAME = 0x204C60
 
-PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
-PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
-PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
-PATCHRAM_NUMBER_OF_SLOTS        = 192
-PATCHRAM_ALIGNED                = False
+    # Memory Sections
+    #                          start,    end,      is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x0, 0x90000, True, False),
+        MemorySection(0xD0000, 0xD8000, False, True),
+        # MemorySection(0xe0000,  0x1f0000, True , False),
+        MemorySection(0x200000, 0x228000, False, True),
+        MemorySection(0x260000, 0x268000, True, False),
+        # MemorySection(0x280000, 0x2a0000, True , False),
+        MemorySection(0x318000, 0x320000, False, False),
+        MemorySection(0x324000, 0x360000, False, False),
+        MemorySection(0x362000, 0x362100, False, False),
+        MemorySection(0x363000, 0x363100, False, False),
+        MemorySection(0x600000, 0x600800, False, False),
+        MemorySection(0x640000, 0x640800, False, False),
+        MemorySection(0x650000, 0x650800, False, False),
+        # MemorySection(0x680000, 0x800000, False, False)
+    ]
+
+    PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000
+    PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
+    PATCHRAM_VALUE_TABLE_ADDRESS = 0xD0000
+    PATCHRAM_NUMBER_OF_SLOTS = 192
+    PATCHRAM_ALIGNED = False

internalblue/fw/fw_0x6109.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
 
 # fw_0x6109.py
 #
@@ -25,362 +25,381 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
-
-# Firmware Infos
-# This runs on Nexus 5, Xperia Z3, Samsung Galaxy Note 3
-FW_NAME = "BCM4335C0"
-
-# Device Infos
-DEVICE_NAME = 0x2178B4  # [type: 1byte] [len: 1byte] [name: len byte]
-BD_ADDR = 0x210C2C
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
 
-# Memory Sections
-#                          start,    end,      is_rom? is_ram?
-SECTIONS = [ MemorySection(0x0,      0x90000,  True , False),
-             MemorySection(0xd0000,  0xd8000,  False, True ),
-            #MemorySection(0xe0000,  0x1f0000, True , False),
-             MemorySection(0x200000, 0x228000, False, True ),
-             MemorySection(0x260000, 0x268000, True , False),
-            #MemorySection(0x280000, 0x2a0000, True , False),
-             MemorySection(0x318000, 0x320000, False, False),
-             MemorySection(0x324000, 0x360000, False, False),
-             MemorySection(0x362000, 0x362100, False, False),
-             MemorySection(0x363000, 0x363100, False, False),
-             MemorySection(0x600000, 0x600800, False, False),
-             MemorySection(0x640000, 0x640800, False, False),
-             MemorySection(0x650000, 0x650800, False, False),
-            #MemorySection(0x680000, 0x800000, False, False)
-            ]
+class BCM4335C0(FirmwareDefinition):
+    # Firmware Infos
+    # This runs on Nexus 5, Xperia Z3, Samsung Galaxy Note 3
+    FW_NAME = "BCM4335C0"
 
-# BLOC struct head which points to the first bloc struct (double-linked list)
-BLOC_HEAD = 0x203094
+    # Device Infos
+    DEVICE_NAME = 0x2178B4  # [type: 1byte] [len: 1byte] [name: len byte]
+    BD_ADDR = 0x210C2C
 
-# QUEU struct head which points to the first queue struct (double-linked list)
-QUEUE_HEAD = 0x20307C
-QUEUE_NAMES = ["tran_HCIEvent", "tran_ACLData", "tran_SCOData", "tran_UartBridgeNonHCIEvent", "tran_DiagData",
-               "tran_HIDUsbKBEvt", "tran_HIDUsbMSEvt", "tran_HIDUsbMSCtrl", "tran_HIDUsbKBCtrl", "tran_HidAuxData",
-               "lm_Cmd", "hci_HciCommand", "lm_deferredAction", "lrmmsm_cmd", "liteHostEvent", "litehostRcvdL2capData"
-               ]
+    # Memory Sections
+    #                          start,    end,      is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x0, 0x90000, True, False),
+        MemorySection(0xD0000, 0xD8000, False, True),
+        # MemorySection(0xe0000,  0x1f0000, True , False),
+        MemorySection(0x200000, 0x228000, False, True),
+        MemorySection(0x260000, 0x268000, True, False),
+        # MemorySection(0x280000, 0x2a0000, True , False),
+        MemorySection(0x318000, 0x320000, False, False),
+        MemorySection(0x324000, 0x360000, False, False),
+        MemorySection(0x362000, 0x362100, False, False),
+        MemorySection(0x363000, 0x363100, False, False),
+        MemorySection(0x600000, 0x600800, False, False),
+        MemorySection(0x640000, 0x640800, False, False),
+        MemorySection(0x650000, 0x650800, False, False),
+        # MemorySection(0x680000, 0x800000, False, False)
+    ]
 
+    # BLOC struct head which points to the first bloc struct (double-linked list)
+    BLOC_HEAD = 0x203094
 
-# Connection Structure and Table
-CONNECTION_ARRAY_ADDRESS = 0x002038E8
-CONNECTION_MAX           = 11
-CONNECTION_STRUCT_LENGTH = 0x14C
+    # QUEU struct head which points to the first queue struct (double-linked list)
+    QUEUE_HEAD = 0x20307C
+    QUEUE_NAMES = [
+        "tran_HCIEvent",
+        "tran_ACLData",
+        "tran_SCOData",
+        "tran_UartBridgeNonHCIEvent",
+        "tran_DiagData",
+        "tran_HIDUsbKBEvt",
+        "tran_HIDUsbMSEvt",
+        "tran_HIDUsbMSCtrl",
+        "tran_HIDUsbKBCtrl",
+        "tran_HidAuxData",
+        "lm_Cmd",
+        "hci_HciCommand",
+        "lm_deferredAction",
+        "lrmmsm_cmd",
+        "liteHostEvent",
+        "litehostRcvdL2capData",
+    ]
 
+    # Connection Structure and Table
+    CONNECTION_ARRAY_ADDRESS = 0x002038E8
+    CONNECTION_MAX = 11
+    CONNECTION_STRUCT_LENGTH = 0x14C
 
-# Patchram
-PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
-PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
-PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
-PATCHRAM_NUMBER_OF_SLOTS        = 128
-PATCHRAM_ALIGNED                = True #use readMemAligned, not accessible via ReadRAM HCI command on Nexus 5
+    # Patchram
+    PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
+    PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000
+    PATCHRAM_VALUE_TABLE_ADDRESS = 0xD0000
+    PATCHRAM_NUMBER_OF_SLOTS = 128
+    PATCHRAM_ALIGNED = (
+        True  # use readMemAligned, not accessible via ReadRAM HCI command on Nexus 5
+    )
 
+    # Snippet for sendLcpPacket()
+    SENDLCP_CODE_BASE_ADDRESS = 0x00211900
+    SENDLCP_ASM_CODE = """
+            push {r4,lr}
+            
+            // we want to call lmulp_sendLcp(conn_index, input, length)
+            
+            mov r0,  %d     // connection index, starts at 0
+            ldr r1, =payload
+            mov r2, %d      // length
+            bl  0x66760     // lmulp_sendLcp
+            
+            pop {r4,pc}     // go back
+    
+            .align          // The payload (LMP packet) must be 4-byte aligend (memcpy needs aligned addresses)
+            payload:        // Note: the payload will be appended here by the sendLmpPacket() function
+            """
 
-# Snippet for sendLcpPacket()
-SENDLCP_CODE_BASE_ADDRESS = 0x00211900
-SENDLCP_ASM_CODE = """
-        push {r4,lr}
-        
-        // we want to call lmulp_sendLcp(conn_index, input, length)
-        
-        mov r0,  %d     // connection index, starts at 0
-        ldr r1, =payload
-        mov r2, %d      // length
-        bl  0x66760     // lmulp_sendLcp
-        
-        pop {r4,pc}     // go back
+    # Snippet for sendLmpPacketLegacy()
+    SENDLMP_CODE_BASE_ADDRESS = 0xD7500
+    SENDLMP_ASM_CODE = """
+            push {r4,lr}
+    
+            // malloc buffer for LMP packet
+            bl 0x3F17E      // malloc_0x20_bloc_buffer_memzero
+            mov r4, r0      // store buffer for LMP packet inside r4
+    
+            // fill buffer
+            add r0, 0xC         // The actual LMP packet must start at offset 0xC in the buffer.
+                                // The first 12 bytes are (supposely?) unused and remain zero.
+            ldr r1, =payload    // LMP packet is stored at the end of the snippet
+            mov r2, 20          // Max. size of an LMP packet is 19 (I guess). The send_LMP_packet
+                                // function will use the LMP opcode to lookup the actual size and
+                                // use it for actually transmitting the correct number of bytes.
+            bl  0x2e03c         // memcpy
+    
+            // load conn struct pointer (needed for determine if we are master or slave)
+            mov r0, %d      // connection number is injected by sendLmpPacket()
+            bl 0x42c04      // find connection struct from conn nr (r0 will hold pointer to conn struct)
+    
+            // set tid bit if we are the slave
+            ldr r1, [r0, 0x1c]  // Load a bitmap from the connection struct into r1.
+            lsr r1, 15          // The 'we are master'-bit is at position 15 of this bitmap
+            and r1, 0x1         // isolate the bit to get the correct value for the TID bit
+            ldr r2, [r4, 0xC]   // Load the LMP opcode into r2. Note: The opcode was already shifted
+                                // left by 1 bit (done by sendLmpPacket()). The TID bit goes into
+                                // the LSB (least significant bit) of this shifted opcode byte.
+            orr r2, r1          // insert the TID bit into the byte
+            str r2, [r4, 0xC]   // Store the byte back into the LMP packet buffer
+    
+    
+            // send LMP packet
+            mov r1, r4      // load the address of the LMP packet buffer into r1.
+                            // r0 still contains the connection number.
+            pop {r4,lr}     // restore r4 and the lr
+            b 0xf81a        // branch to send_LMP_packet. send_LMP_packet will do the return for us.
+    
+            .align          // The payload (LMP packet) must be 4-byte aligend (memcpy needs aligned addresses)
+            payload:        // Note: the payload will be appended here by the sendLmpPacket() function
+            """
 
-        .align          // The payload (LMP packet) must be 4-byte aligend (memcpy needs aligned addresses)
-        payload:        // Note: the payload will be appended here by the sendLmpPacket() function
+    # Snippet for fuzzLmp()
+    FUZZLMP_HOOK_ADDRESS = 0x1E48C  # execute standard SendLmpPdu HCI to fill parameters
+    FUZZLMP_CODE_BASE_ADDRESS = 0xD7500
+    FUZZLMP_ASM_CODE = """
+            // This hook is put into the end of bthci_cmd_vs_SendLmpPdu_1E45A,
+            // so command parsing is still performed as normal. We jump in
+            // before bthci_cmd_vs_SendLmpPdu pops and calls DHM_LMPTx.
+    
+            // put length argument into table_entry
+            // payload[5] holds the size argument
+            ldr   r7, =table_entry
+            add   r7, #4         // length offset within table entry
+            ldrb r6, [r4, #5]
+            strb r6, [r7]        
+    
+            // we need to do the original pop...
+            pop  {r4-r8, lr}
+    
+            // now we simply continue like the original DHM_LMPTx function
+            push  {r4-r10, lr}   // code at 0xF81A
+            mov   r8, r0
+            movs  r4, r1
+    
+            // part of the check if hook_LMP_TxFilter_200D38 is installed
+            ldr.w r9, =0x200D80
+            sub.w r9, r9, #0x50
+            ldr.w r2, [r9, #8]
+    
+            mov   r1, r4         // code at 0xF840
+            mov   r0, r8
+            bl    0x50050        // rm_getDHMAclPtr_50050
+            cmp   r0, #1
+            // skip check if we actually got a ptr 
+            // get connection struct, code at 0xF850
+            ldr   r0, =0x206eac  // table_for_bt_tx_structs_206EAC
+            ldr.w r7, [r8]
+            add.w r6, r0, r7, lsl #5
+            ldrb  r0, [r6, #0x1f]
+            cmp   r0, #1
+            // skip check in conection struct
+            ldrb  r0, [r4, #0xc] // ptr_to_opcode = buffer_cpy + 12;
+            lsrs  r1, r0, #1     // buffer_cpy[12] >> 1
+            add.w r0, r4, #0x0c
+    
+            // enable for debugging: ignore the remaining code and continue like normal opcode
+            //b     0xF870
+    
+            // now we regularily would call the opcode conversion table function
+            // however, we do not use lm_getLmpInfoType_3F2D8 but insert our own table here        
+            ldr    r1, =table_entry // table_ptr with exactly one entry, so no offsets included here
+            ldr    r0, =table_entry
+    
+            // branch back to DHM_LMPTx position after bl lm_getLmpInfoType
+            b     0xF874
+    
+            .align
+            table_entry:
+                .byte 0x35  //nullsub1+1
+                .byte 0xAC 
+                .byte 0x00
+                .byte 0x00
+                .byte 0x20  //length, will be overwritten by us anyways, but can not be longer than one buffer (0x20)  
+                .byte 0x00    
+                .byte 0x00
+                .byte 0x00
+            """
+
+    # Assembler snippet for the readMemAligned() function
+    READ_MEM_ALIGNED_ASM_LOCATION = 0xD7900
+    READ_MEM_ALIGNED_ASM_SNIPPET = """
+            push {r4, lr}
+    
+            // malloc HCI event buffer
+            mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
+            mov  r1, %d      // readMemAligned() injects the number of bytes it wants to read here
+            add  r1, 6       // + type and length + 'READ'
+            bl   0x7AFC      // malloc_hci_event_buffer (will automatically copy event code and length into the buffer)
+            mov  r4, r0      // save pointer to the buffer in r4
+    
+            // append our custom header (the word 'READ') after the event code and event length field
+            add  r0, 2            // write after the length field
+            ldr  r1, =0x44414552  // 'READ'
+            str  r1, [r0]
+            add  r0, 4            // advance the pointer. r0 now points to the beginning of our read data
+    
+            // copy data to buffer
+            ldr  r1, =0x%x  // readMemAligned() injects the read_address here. r1 will be used as src pointer in the loop
+            mov  r2, %d     // readMemAligned() injects the number of dwords to read here. r2 will be the loop counter
+        loop:
+            ldr  r3, [r1]   // read 4 bytes from the read_address
+            str  r3, [r0]   // store them inside the HCI buffer
+            add  r0, 4      // advance the buffer pointer
+            add  r1, 4      // advance the read_address
+            subs r2, 1      // decrement the loop variable
+            bne  loop       // branch if r2 is not zero yet
+    
+            // send HCI buffer to the host
+            mov r0, r4      // r4 still points to the beginning of the HCI buffer
+            bl  0x398c1     // send_hci_event_without_free()
+    
+            // free HCI buffer
+            mov r0, r4
+            bl  0x3FA36     // free_bloc_buffer_aligned
+    
+            pop {r4, pc}    // return
         """
 
-# Snippet for sendLmpPacketLegacy()
-SENDLMP_CODE_BASE_ADDRESS = 0xd7500
-SENDLMP_ASM_CODE = """
-        push {r4,lr}
-
-        // malloc buffer for LMP packet
-        bl 0x3F17E      // malloc_0x20_bloc_buffer_memzero
-        mov r4, r0      // store buffer for LMP packet inside r4
-
-        // fill buffer
-        add r0, 0xC         // The actual LMP packet must start at offset 0xC in the buffer.
-                            // The first 12 bytes are (supposely?) unused and remain zero.
-        ldr r1, =payload    // LMP packet is stored at the end of the snippet
-        mov r2, 20          // Max. size of an LMP packet is 19 (I guess). The send_LMP_packet
-                            // function will use the LMP opcode to lookup the actual size and
-                            // use it for actually transmitting the correct number of bytes.
-        bl  0x2e03c         // memcpy
-
-        // load conn struct pointer (needed for determine if we are master or slave)
-        mov r0, %d      // connection number is injected by sendLmpPacket()
-        bl 0x42c04      // find connection struct from conn nr (r0 will hold pointer to conn struct)
-
-        // set tid bit if we are the slave
-        ldr r1, [r0, 0x1c]  // Load a bitmap from the connection struct into r1.
-        lsr r1, 15          // The 'we are master'-bit is at position 15 of this bitmap
-        and r1, 0x1         // isolate the bit to get the correct value for the TID bit
-        ldr r2, [r4, 0xC]   // Load the LMP opcode into r2. Note: The opcode was already shifted
-                            // left by 1 bit (done by sendLmpPacket()). The TID bit goes into
-                            // the LSB (least significant bit) of this shifted opcode byte.
-        orr r2, r1          // insert the TID bit into the byte
-        str r2, [r4, 0xC]   // Store the byte back into the LMP packet buffer
-
-
-        // send LMP packet
-        mov r1, r4      // load the address of the LMP packet buffer into r1.
-                        // r0 still contains the connection number.
-        pop {r4,lr}     // restore r4 and the lr
-        b 0xf81a        // branch to send_LMP_packet. send_LMP_packet will do the return for us.
-
-        .align          // The payload (LMP packet) must be 4-byte aligend (memcpy needs aligned addresses)
-        payload:        // Note: the payload will be appended here by the sendLmpPacket() function
-        """
-
-
-# Snippet for fuzzLmp()
-FUZZLMP_HOOK_ADDRESS = 0x1e48c  # execute standard SendLmpPdu HCI to fill parameters
-FUZZLMP_CODE_BASE_ADDRESS = 0xd7500
-FUZZLMP_ASM_CODE = """
-        // This hook is put into the end of bthci_cmd_vs_SendLmpPdu_1E45A,
-        // so command parsing is still performed as normal. We jump in
-        // before bthci_cmd_vs_SendLmpPdu pops and calls DHM_LMPTx.
-
-        // put length argument into table_entry
-        // payload[5] holds the size argument
-        ldr   r7, =table_entry
-        add   r7, #4         // length offset within table entry
-        ldrb r6, [r4, #5]
-        strb r6, [r7]        
-
-        // we need to do the original pop...
-        pop  {r4-r8, lr}
-
-        // now we simply continue like the original DHM_LMPTx function
-        push  {r4-r10, lr}   // code at 0xF81A
-        mov   r8, r0
-        movs  r4, r1
-
-        // part of the check if hook_LMP_TxFilter_200D38 is installed
-        ldr.w r9, =0x200D80
-        sub.w r9, r9, #0x50
-        ldr.w r2, [r9, #8]
-
-        mov   r1, r4         // code at 0xF840
-        mov   r0, r8
-        bl    0x50050        // rm_getDHMAclPtr_50050
-        cmp   r0, #1
-        // skip check if we actually got a ptr 
-        // get connection struct, code at 0xF850
-        ldr   r0, =0x206eac  // table_for_bt_tx_structs_206EAC
-        ldr.w r7, [r8]
-        add.w r6, r0, r7, lsl #5
-        ldrb  r0, [r6, #0x1f]
-        cmp   r0, #1
-        // skip check in conection struct
-        ldrb  r0, [r4, #0xc] // ptr_to_opcode = buffer_cpy + 12;
-        lsrs  r1, r0, #1     // buffer_cpy[12] >> 1
-        add.w r0, r4, #0x0c
-
-        // enable for debugging: ignore the remaining code and continue like normal opcode
-        //b     0xF870
-
-        // now we regularily would call the opcode conversion table function
-        // however, we do not use lm_getLmpInfoType_3F2D8 but insert our own table here        
-        ldr    r1, =table_entry // table_ptr with exactly one entry, so no offsets included here
-        ldr    r0, =table_entry
-
-        // branch back to DHM_LMPTx position after bl lm_getLmpInfoType
-        b     0xF874
-
-        .align
-        table_entry:
-            .byte 0x35  //nullsub1+1
-            .byte 0xAC 
-            .byte 0x00
-            .byte 0x00
-            .byte 0x20  //length, will be overwritten by us anyways, but can not be longer than one buffer (0x20)  
-            .byte 0x00    
-            .byte 0x00
-            .byte 0x00
-        """
-
-
-# Assembler snippet for the readMemAligned() function
-READ_MEM_ALIGNED_ASM_LOCATION = 0xd7900
-READ_MEM_ALIGNED_ASM_SNIPPET = """
-        push {r4, lr}
-
-        // malloc HCI event buffer
-        mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
-        mov  r1, %d      // readMemAligned() injects the number of bytes it wants to read here
-        add  r1, 6       // + type and length + 'READ'
-        bl   0x7AFC      // malloc_hci_event_buffer (will automatically copy event code and length into the buffer)
-        mov  r4, r0      // save pointer to the buffer in r4
-
-        // append our custom header (the word 'READ') after the event code and event length field
-        add  r0, 2            // write after the length field
-        ldr  r1, =0x44414552  // 'READ'
-        str  r1, [r0]
-        add  r0, 4            // advance the pointer. r0 now points to the beginning of our read data
-
-        // copy data to buffer
-        ldr  r1, =0x%x  // readMemAligned() injects the read_address here. r1 will be used as src pointer in the loop
-        mov  r2, %d     // readMemAligned() injects the number of dwords to read here. r2 will be the loop counter
-    loop:
-        ldr  r3, [r1]   // read 4 bytes from the read_address
-        str  r3, [r0]   // store them inside the HCI buffer
-        add  r0, 4      // advance the buffer pointer
-        add  r1, 4      // advance the read_address
-        subs r2, 1      // decrement the loop variable
-        bne  loop       // branch if r2 is not zero yet
-
-        // send HCI buffer to the host
-        mov r0, r4      // r4 still points to the beginning of the HCI buffer
-        bl  0x398c1     // send_hci_event_without_free()
-
-        // free HCI buffer
-        mov r0, r4
-        bl  0x3FA36     // free_bloc_buffer_aligned
-
-        pop {r4, pc}    // return
+    # Assembler snippet for tracepoints
+    TRACEPOINT_BODY_ASM_LOCATION = 0xD7A00
+    TRACEPOINT_HOOKS_LOCATION = 0xD7B00
+    TRACEPOINT_HOOK_SIZE = 28
+    TRACEPOINT_HOOK_ASM = """
+            push {r0-r12, lr}       // save all registers on the stack (except sp and pc)
+            ldr  r6, =0x%x          // addTracepoint() injects pc of original tracepoint here
+            mov  r7, %d             // addTracepoint() injects the patchram slot of the hook patch
+            bl   0x%x               // addTracepoint() injects TRACEPOINT_BODY_ASM_LOCATION here
+            pop  {r0-r12, lr}       // restore registers
+    
+            // branch back to the original instruction
+            b 0x%x                  // addTracepoint() injects the address of the tracepoint
     """
-
-# Assembler snippet for tracepoints
-TRACEPOINT_BODY_ASM_LOCATION = 0xd7a00
-TRACEPOINT_HOOKS_LOCATION = 0xd7b00
-TRACEPOINT_HOOK_SIZE = 28
-TRACEPOINT_HOOK_ASM = """
-        push {r0-r12, lr}       // save all registers on the stack (except sp and pc)
-        ldr  r6, =0x%x          // addTracepoint() injects pc of original tracepoint here
-        mov  r7, %d             // addTracepoint() injects the patchram slot of the hook patch
-        bl   0x%x               // addTracepoint() injects TRACEPOINT_BODY_ASM_LOCATION here
-        pop  {r0-r12, lr}       // restore registers
-
-        // branch back to the original instruction
-        b 0x%x                  // addTracepoint() injects the address of the tracepoint
-"""
-TRACEPOINT_RAM_DUMP_PKT_COUNT = 670     # <ramsize> / <packetsize>   where packetsize is 244
-TRACEPOINT_BODY_ASM_SNIPPET = """
-        mov   r8, lr     // save link register in r8
-
-        // save status register in r5
-        mrs  r5, cpsr
-
-        // malloc HCI event buffer
-        mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
-        mov  r1, 76      // buffer size: size of registers (68 bytes) + type and length + 'TRACE_'
-        bl   0x7AFC      // malloc_hci_event_buffer (will automatically copy event code and length into the buffer)
-        mov  r4, r0      // save pointer to the buffer in r4
-
-        // append our custom header (the word 'TRACE_') after the event code and event length field
-        add  r0, 2            // write after the length field
-        ldr  r1, =0x43415254  // 'TRAC'
-        str  r1, [r0]
-        add  r0, 4            // advance the pointer.
-        ldr  r1, =0x5f45      // 'E_'
-        strh r1, [r0]
-        add  r0, 2            // advance the pointer. r0 now points to the start of the register values
-
-        // store pc
-        str  r6, [r0]    // r6 still contains the address of the original pc
-        add  r0, 4       // advance the pointer.
-
-        // store sp
-        mov  r1, 56      // 14 saved registers * 4
-        add  r1, sp
-        str  r1, [r0]
-        add  r0, 4       // advance the pointer.
-
-        // store status register
-        str  r5, [r0]
-        add  r0, 4       // advance the pointer.
-
-        // store other registers
-        mov  r1, sp
-        mov  r2, 56
-        bl   0x2e03c+1   // memcpy(dst, src, len)
-
-        // send HCI buffer to the host
-        mov  r0, r4      // r4 still points to the beginning of the HCI buffer
-        bl   0x398c1     // send_hci_event_without_free()
-
-        // free HCI buffer
-        mov  r0, r4
-        bl   0x3FA36     // free_bloc_buffer_aligned
-
-        mov  r0, r7      // r7 still contains the patchram slot number
-        bl   0x311AA     // disable_patchram_slot(slot)
-
-        // restore status register
-        msr  cpsr_f, r5
-
-        // dump ram
-        bl   dump_ram
-
-        mov  lr, r8      // restore lr from r8
-        bx   lr          // return
-
-
-// function to dump the RAM as multiple HCI packets:
-dump_ram:
-        push {r4-r6,lr}
-
-        // malloc HCI event buffer
-        mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
-        mov  r1, 252     // buffer size
-        bl   0x7AFC      // malloc_hci_event_buffer (will automatically copy event code and length into the buffer)
-        mov  r4, r0      // save pointer to the buffer in r4
-
-        // append our custom header (the word 'RAM___') after the event code and event length field
-        add  r0, 2            // write after the length field
-        ldr  r1, =0x5f4d4152  // 'RAM_'
-        str  r1, [r0]
-        add  r0, 4            // advance the pointer.
-        ldr  r1, =0x5f5f      // '__'
-        strh r1, [r0]
-        add  r0, 2            // advance the pointer. r0 now points to the start of the actual payload
-
-        mov  r5, 0x200000     // start of ram
-        ldr  r6, =%d          // number of ramdump packets to be sent
-
-        dump_ram_loop:
-            // Set r0 to point to the beginning of the payload in the hci buffer
-            mov  r0, r4
-            add  r0, 8
-
-            // store current address
-            str  r5, [r0]    // r5 contains the address in RAM which is send next
+    TRACEPOINT_RAM_DUMP_PKT_COUNT = (
+        670  # <ramsize> / <packetsize>   where packetsize is 244
+    )
+    TRACEPOINT_BODY_ASM_SNIPPET = (
+        """
+            mov   r8, lr     // save link register in r8
+    
+            // save status register in r5
+            mrs  r5, cpsr
+    
+            // malloc HCI event buffer
+            mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
+            mov  r1, 76      // buffer size: size of registers (68 bytes) + type and length + 'TRACE_'
+            bl   0x7AFC      // malloc_hci_event_buffer (will automatically copy event code and length into the buffer)
+            mov  r4, r0      // save pointer to the buffer in r4
+    
+            // append our custom header (the word 'TRACE_') after the event code and event length field
+            add  r0, 2            // write after the length field
+            ldr  r1, =0x43415254  // 'TRAC'
+            str  r1, [r0]
+            add  r0, 4            // advance the pointer.
+            ldr  r1, =0x5f45      // 'E_'
+            strh r1, [r0]
+            add  r0, 2            // advance the pointer. r0 now points to the start of the register values
+    
+            // store pc
+            str  r6, [r0]    // r6 still contains the address of the original pc
             add  r0, 4       // advance the pointer.
-
-            // copy ram to hci buffer
-            mov  r1, r5
-            mov  r2, 244
-            bl   0x2e03c     // memcpy
-
+    
+            // store sp
+            mov  r1, 56      // 14 saved registers * 4
+            add  r1, sp
+            str  r1, [r0]
+            add  r0, 4       // advance the pointer.
+    
+            // store status register
+            str  r5, [r0]
+            add  r0, 4       // advance the pointer.
+    
+            // store other registers
+            mov  r1, sp
+            mov  r2, 56
+            bl   0x2e03c+1   // memcpy(dst, src, len)
+    
             // send HCI buffer to the host
             mov  r0, r4      // r4 still points to the beginning of the HCI buffer
             bl   0x398c1     // send_hci_event_without_free()
-
-            // delay loop; Workaround: without the delay, a lot of packets are not actually sent
-            // through HCI.
-            mov  r0, 0x1000
-            delay_loop:
-                subs r0, 1
-                bne delay_loop
-
-            // increment the RAM pointer; decrement the counter
-            add  r5, 244
-            subs r6, 1
-
-            bne  dump_ram_loop
-
-        // free HCI buffer
-        mov  r0, r4
-        bl   0x3FA36     // free_bloc_buffer_aligned
-
-        pop  {r4-r6,pc}
-""" % TRACEPOINT_RAM_DUMP_PKT_COUNT
+    
+            // free HCI buffer
+            mov  r0, r4
+            bl   0x3FA36     // free_bloc_buffer_aligned
+    
+            mov  r0, r7      // r7 still contains the patchram slot number
+            bl   0x311AA     // disable_patchram_slot(slot)
+    
+            // restore status register
+            msr  cpsr_f, r5
+    
+            // dump ram
+            bl   dump_ram
+    
+            mov  lr, r8      // restore lr from r8
+            bx   lr          // return
+    
+    
+    // function to dump the RAM as multiple HCI packets:
+    dump_ram:
+            push {r4-r6,lr}
+    
+            // malloc HCI event buffer
+            mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
+            mov  r1, 252     // buffer size
+            bl   0x7AFC      // malloc_hci_event_buffer (will automatically copy event code and length into the buffer)
+            mov  r4, r0      // save pointer to the buffer in r4
+    
+            // append our custom header (the word 'RAM___') after the event code and event length field
+            add  r0, 2            // write after the length field
+            ldr  r1, =0x5f4d4152  // 'RAM_'
+            str  r1, [r0]
+            add  r0, 4            // advance the pointer.
+            ldr  r1, =0x5f5f      // '__'
+            strh r1, [r0]
+            add  r0, 2            // advance the pointer. r0 now points to the start of the actual payload
+    
+            mov  r5, 0x200000     // start of ram
+            ldr  r6, =%d          // number of ramdump packets to be sent
+    
+            dump_ram_loop:
+                // Set r0 to point to the beginning of the payload in the hci buffer
+                mov  r0, r4
+                add  r0, 8
+    
+                // store current address
+                str  r5, [r0]    // r5 contains the address in RAM which is send next
+                add  r0, 4       // advance the pointer.
+    
+                // copy ram to hci buffer
+                mov  r1, r5
+                mov  r2, 244
+                bl   0x2e03c     // memcpy
+    
+                // send HCI buffer to the host
+                mov  r0, r4      // r4 still points to the beginning of the HCI buffer
+                bl   0x398c1     // send_hci_event_without_free()
+    
+                // delay loop; Workaround: without the delay, a lot of packets are not actually sent
+                // through HCI.
+                mov  r0, 0x1000
+                delay_loop:
+                    subs r0, 1
+                    bne delay_loop
+    
+                // increment the RAM pointer; decrement the counter
+                add  r5, 244
+                subs r6, 1
+    
+                bne  dump_ram_loop
+    
+            // free HCI buffer
+            mov  r0, r4
+            bl   0x3FA36     // free_bloc_buffer_aligned
+    
+            pop  {r4-r6,pc}
+    """
+        % TRACEPOINT_RAM_DUMP_PKT_COUNT
+    )

internalblue/fw/fw_0x6119.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
 
 # fw_0x6119.py
 #
@@ -27,66 +27,67 @@
 
 # Firmware Infos
 # This runs on Rasperry Pi 3+
-FW_NAME = "BCM4345C0"
 
-# Device Infos
-DEVICE_NAME = 0x204954
 
-# Memory Sections
-class MemorySection:
-    def __init__(self, start_addr, end_addr, is_rom, is_ram):
-        self.start_addr = start_addr
-        self.end_addr = end_addr
-        self.is_rom = is_rom
-        self.is_ram = is_ram
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
-    def size(self):
-        return self.end_addr - self.start_addr
 
-# Memory Sections
-#                          start,    end,      is_rom? is_ram?
-SECTIONS = [ MemorySection(0x0,      0x90000,  True , False),
-             MemorySection(0xd0000,  0xd8000,  False, True ),
-            #MemorySection(0xe0000,  0x1f0000, True , False),
-             MemorySection(0x200000, 0x228000, False, True ),
-             MemorySection(0x260000, 0x268000, True , False),
-            #MemorySection(0x280000, 0x2a0000, True , False),
-             MemorySection(0x318000, 0x320000, False, False),
-             MemorySection(0x324000, 0x360000, False, False),
-             MemorySection(0x362000, 0x362100, False, False),
-             MemorySection(0x363000, 0x363100, False, False),
-             MemorySection(0x600000, 0x600800, False, False),
-             MemorySection(0x640000, 0x640800, False, False),
-             MemorySection(0x650000, 0x650800, False, False),
-            #MemorySection(0x680000, 0x800000, False, False)
-            ]
+class BCM4345C0(FirmwareDefinition):
+    FW_NAME = "BCM4345C0"
 
-# Connection Structure and Table
-CONNECTION_ARRAY_ADDRESS = 0x204ba8
-CONNECTION_MAX           = 11
-CONNECTION_STRUCT_LENGTH = 0x150
+    # Device Infos
+    DEVICE_NAME = 0x204954
 
-# Patchram
-PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
-PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
-PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
-PATCHRAM_NUMBER_OF_SLOTS        = 128
-PATCHRAM_ALIGNED                = False
+    # Memory Sections
+    #                          start,    end,      is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x0, 0x90000, True, False),
+        MemorySection(0xD0000, 0xD8000, False, True),
+        # MemorySection(0xe0000,  0x1f0000, True , False),
+        MemorySection(0x200000, 0x228000, False, True),
+        MemorySection(0x260000, 0x268000, True, False),
+        # MemorySection(0x280000, 0x2a0000, True , False),
+        MemorySection(0x318000, 0x320000, False, False),
+        MemorySection(0x324000, 0x360000, False, False),
+        MemorySection(0x362000, 0x362100, False, False),
+        MemorySection(0x363000, 0x363100, False, False),
+        MemorySection(0x600000, 0x600800, False, False),
+        MemorySection(0x640000, 0x640800, False, False),
+        MemorySection(0x650000, 0x650800, False, False),
+        # MemorySection(0x680000, 0x800000, False, False)
+    ]
 
-# Snippet for sendLcpPacket()
-SENDLCP_CODE_BASE_ADDRESS = 0x21f000
-SENDLCP_ASM_CODE = """
-        push {r4,lr}
+    # Connection Structure and Table
+    CONNECTION_ARRAY_ADDRESS = 0x204BA8
+    CONNECTION_MAX = 11
+    CONNECTION_STRUCT_LENGTH = 0x150
 
-        // we want to call lmulp_sendLcp(conn_index, input, length)
+    # Patchram
+    PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
+    PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000
+    PATCHRAM_VALUE_TABLE_ADDRESS = 0xD0000
+    PATCHRAM_NUMBER_OF_SLOTS = 128
+    PATCHRAM_ALIGNED = False
 
-        mov r0,  %d     // connection index, starts at 0
-        ldr r1, =payload
-        mov r2, %d      // length
-        bl  0x92062     // lmulp_sendLcp
+    # Heap
+    BLOC_HEAD = 0x200490  # g_dynamic_memory_GeneralUsePools
+    BLOC_NG = True  # Next Generation Bloc Buffer
 
-        pop {r4,pc}     // go back
-
-        .align          // The payload (LMP packet) must be 4-byte aligend (memcpy needs aligned addresses)
-        payload:        // Note: the payload will be appended here by the sendLmpPacket() function
-        """
+    # Snippet for sendLcpPacket()
+    SENDLCP_CODE_BASE_ADDRESS = 0x21F000
+    SENDLCP_ASM_CODE = """
+            push {r4,lr}
+    
+            // we want to call lmulp_sendLcp(conn_index, input, length)
+    
+            mov r0,  %d     // connection index, starts at 0
+            ldr r1, =payload
+            mov r2, %d      // length
+            bl  0x92062     // lmulp_sendLcp
+    
+            pop {r4,pc}     // go back
+    
+            .align          // The payload (LMP packet) must be 4-byte aligend (memcpy needs aligned addresses)
+            payload:        // Note: the payload will be appended here by the sendLmpPacket() function
+            """

internalblue/fw/fw_0x617e.py

@@ -20,24 +20,30 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
-
-# Firmware Infos
-# iPhone 6
-FW_NAME = "BCM4345B0"
+from .fw import MemorySection, FirmwareDefinition
+from __future__ import absolute_import
 
 
-# Memory Sections
-#                          start,    end,           is_rom? is_ram?
-SECTIONS = [ MemorySection(0x00000000, 0x000c07ff,  True,  False),  # Internal ROM
-             MemorySection(0x000d0000, 0x000dffff,  False, True),   # Internal Memory Patchram Contents
-             MemorySection(0x00200400, 0x00201cff,  False, True),   # Internal Memory Cortex M3
-             ]
+class BCM4345B0(FirmwareDefinition):
+    # Firmware Infos
+    # iPhone 6
+    FW_NAME = "BCM4345B0"
 
-# Patchram
-#PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000 #TODO needs to be aligned read
-#PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
-#PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
-#PATCHRAM_NUMBER_OF_SLOTS        = 128
-#PATCHRAM_ALIGNED                = True
-# only seems to work 4-byte aligned here ...
+
+    # Memory Sections
+    #                          start,    end,           is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x00000000, 0x000C07FF, True, False),  # Internal ROM
+        MemorySection(
+            0x000D0000, 0x000DFFFF, False, True
+        ),  # Internal Memory Patchram Contents
+        MemorySection(0x00200400, 0x00201CFF, False, True),  # Internal Memory Cortex M3
+    ]
+
+    # Patchram
+    # PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000 #TODO needs to be aligned read
+    # PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
+    # PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
+    # PATCHRAM_NUMBER_OF_SLOTS        = 128
+    # PATCHRAM_ALIGNED                = True
+    # only seems to work 4-byte aligned here ...

internalblue/fw/fw_0x6206.py

@@ -20,24 +20,30 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
-
-# Firmware Infos
-# iPhone SE
-FW_NAME = "BCM4345C1"
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
 
-# Memory Sections
-#                          start,    end,           is_rom? is_ram?
-SECTIONS = [ MemorySection(0x00000000, 0x000c07ff,  True,  False),  # Internal ROM
-             MemorySection(0x000d0000, 0x000dffff,  False, True),   # Internal Memory Patchram Contents
-             MemorySection(0x00200400, 0x00201cff,  False, True),   # Internal Memory Cortex M3
-             ]
+class BCM4345C1(FirmwareDefinition):
+    # Firmware Infos
+    # iPhone SE
+    FW_NAME = "BCM4345C1"
 
-# Patchram
-PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
-PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
-PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
-PATCHRAM_NUMBER_OF_SLOTS        = 128
-PATCHRAM_ALIGNED                = False
-# only seems to work 4-byte aligned here ...
+
+    # Memory Sections
+    #                          start,    end,           is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x00000000, 0x000C07FF, True, False),  # Internal ROM
+        MemorySection(
+            0x000D0000, 0x000DFFFF, False, True
+        ),  # Internal Memory Patchram Contents
+        MemorySection(0x00200400, 0x00201CFF, False, True),  # Internal Memory Cortex M3
+    ]
+
+    # Patchram
+    PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000
+    PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
+    PATCHRAM_VALUE_TABLE_ADDRESS = 0xD0000
+    PATCHRAM_NUMBER_OF_SLOTS = 128
+    PATCHRAM_ALIGNED = False
+    # only seems to work 4-byte aligned here ...

internalblue/fw/fw_default.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
 
 # fw_default.py
 #
@@ -22,14 +22,18 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from __future__ import absolute_import
+from .fw import MemorySection, FirmwareDefinition
 
-# Firmware Infos
-FW_NAME = "default (unknown firmware)"
 
-# Memory Sections
-#                          start,    end,      is_rom? is_ram?
-SECTIONS = [ MemorySection(0x0,      0x90000,  True , False),
-             MemorySection(0xd0000,  0xd8000,  False, True ),
-             MemorySection(0x200000, 0x228000, False, True )
-            ]
+class DefaultFirmware(FirmwareDefinition):
+    # Firmware Infos
+    FW_NAME = "default (unknown firmware)"
+
+    # Memory Sections
+    #                          start,    end,      is_rom? is_ram?
+    SECTIONS = [
+        MemorySection(0x0, 0x90000, True, False),
+        MemorySection(0xD0000, 0xD8000, False, True),
+        MemorySection(0x200000, 0x228000, False, True),
+    ]

internalblue/hcicore.py

@@ -1,39 +1,72 @@
 #!/usr/bin/env python2
 
-import subprocess
+from __future__ import absolute_import
+
+import socket
+import struct
+
+from future import standard_library
+
+standard_library.install_aliases()
+from builtins import str
+from builtins import zip
+from builtins import range
 import datetime
-from pwn import *
+from internalblue.utils.pwnlib_wrapper import log, context, p32, u16, p16, u32
 import fcntl
-from core import InternalBlue
-import hci
-import Queue
+from .core import InternalBlue
+from . import hci
+import queue as queue2k
 import threading
 
+from typing import List, cast, TYPE_CHECKING
+if TYPE_CHECKING:
+    from internalblue import Device
+
+
 # from /usr/include/bluetooth/hci.h:
-#define HCIDEVUP	_IOW('H', 201, int)
-#define HCIGETDEVLIST	_IOR('H', 210, int)
-#define HCIGETDEVINFO	_IOR('H', 211, int)
+# define HCIDEVUP	_IOW('H', 201, int)
+# define HCIGETDEVLIST	_IOR('H', 210, int)
+# define HCIGETDEVINFO	_IOR('H', 211, int)
 
 # ioctl numbers. see http://code.activestate.com/recipes/578225-linux-ioctl-numbers-in-python/
-def _IOR(type, nr, size):
-    return 2 << 30 | type << 8 | nr << 0 | size << 16
-def _IOW(type, nr, size):
-    return 1 << 30 | type << 8 | nr << 0 | size << 16
+def _IOR(_type, nr, size):
+    return 2 << 30 | _type << 8 | nr << 0 | size << 16
 
-HCIDEVUP      = _IOW(ord('H'), 201, 4)
-HCIGETDEVLIST = _IOR(ord('H'), 210, 4)
-HCIGETDEVINFO = _IOR(ord('H'), 211, 4)
+
+def _IOW(_type, nr, size):
+    return 1 << 30 | _type << 8 | nr << 0 | size << 16
+
+
+HCIDEVUP = _IOW(ord("H"), 201, 4)
+HCIGETDEVLIST = _IOR(ord("H"), 210, 4)
+HCIGETDEVINFO = _IOR(ord("H"), 211, 4)
 
 
 class HCICore(InternalBlue):
-
-    def __init__(self, queue_size=1000, btsnooplog_filename='btsnoop.log', log_level='info', fix_binutils='True', data_directory="."):
-        super(HCICore, self).__init__(queue_size, btsnooplog_filename, log_level, fix_binutils, data_directory)
+    def __init__(
+        self,
+        queue_size=1000,
+        btsnooplog_filename="btsnoop.log",
+        log_level="info",
+        fix_binutils="True",
+        data_directory=".",
+        replay=False,
+    ):
+        super(HCICore, self).__init__(
+            queue_size,
+            btsnooplog_filename,
+            log_level,
+            fix_binutils,
+            data_directory,
+            replay,
+        )
         self.btsnooplog_file_lock = threading.Lock()
         self.serial = False
         self.doublecheck = False
 
     def getHciDeviceList(self):
+        # type: () -> List[Device]
         """
         Get a list of available HCI devices. The list is obtained by executing
         ioctl syscalls HCIGETDEVLIST and HCIGETDEVINFO. The returned list 
@@ -50,43 +83,66 @@ class HCICore(InternalBlue):
             s = socket.socket(socket.AF_BLUETOOTH, socket.SOCK_RAW, socket.BTPROTO_HCI)
         # Ticket 6: does not run on Windows with Kali subsystem
         except socket.error:
-            log.warn("Opening a local Bluetooth socket failed. Not running on native Linux?")
+            log.warn(
+                "Opening a local Bluetooth socket failed. Not running on native Linux?"
+            )
             return []
 
         # Do ioctl(s,HCIGETDEVLIST,arg) to get the number of available devices:
         # arg is struct hci_dev_list_req (/usr/include/bluetooth/hci.h)
-        arg =  p32(16) # dl->dev_num = HCI_MAX_DEV which is 16 (little endian)
-        arg += "\x00"*(8*16)
+        arg = p32(16)  # dl->dev_num = HCI_MAX_DEV which is 16 (little endian)
+        arg += b"\x00" * (8 * 16)
         devices_raw = fcntl.ioctl(s.fileno(), HCIGETDEVLIST, arg)
         num_devices = u16(devices_raw[:2])
         log.debug("Found %d HCI devices via ioctl(HCIGETDEVLIST)!" % num_devices)
 
         device_list = []
         for dev_nr in range(num_devices):
-            dev_struct_start = 4 + 8*dev_nr
-            dev_id = u16(devices_raw[dev_struct_start:dev_struct_start+2])
+            dev_struct_start = 4 + 8 * dev_nr
+            dev_id = u16(devices_raw[dev_struct_start : dev_struct_start + 2])
             # arg is struct hci_dev_info (/usr/include/bluetooth/hci.h)
-            arg =  p16(dev_id) # di->dev_id = <device_id>
-            arg += "\x00"*20   # Enough space for name, bdaddr and flags
-            dev_info_raw = fcntl.ioctl(s.fileno(), HCIGETDEVINFO, arg)
-            dev_name   = dev_info_raw[2:10].replace("\x00","")
-            dev_bdaddr = ":".join(["%02X" % ord(x) for x in dev_info_raw[10:16][::-1]])
-            dev_flags  = u32(dev_info_raw[16:20])
+            arg = p16(dev_id)  # di->dev_id = <device_id>
+            arg += b"\x00" * 20  # Enough space for name, bdaddr and flags
+            dev_info_raw = bytearray(fcntl.ioctl(s.fileno(), HCIGETDEVINFO, arg))
+            dev_name = dev_info_raw[2:10].replace(b"\x00", b"").decode()
+            dev_bdaddr = ":".join(["%02X" % x for x in dev_info_raw[10:16][::-1]])
+            dev_flags = u32(dev_info_raw[16:20])
             if dev_flags == 0:
                 dev_flags_str = "DOWN"
             else:
-                dev_flags_str = " ".join([name for flag,name in zip(
-                                bin(dev_flags)[2:][::-1],
-                                ["UP", "INIT", "RUNNING", "PSCAN", "ISCAN", "AUTH",
-                                 "ENCRYPT" , "INQUIRY" , "RAW" , "RESET"]) if flag=="1"])
+                dev_flags_str = " ".join(
+                    [
+                        name
+                        for flag, name in zip(
+                            bin(dev_flags)[2:][::-1],
+                            [
+                                "UP",
+                                "INIT",
+                                "RUNNING",
+                                "PSCAN",
+                                "ISCAN",
+                                "AUTH",
+                                "ENCRYPT",
+                                "INQUIRY",
+                                "RAW",
+                                "RESET",
+                            ],
+                        )
+                        if flag == "1"
+                    ]
+                )
 
-            device_list.append({"dev_id":        dev_id,
-                                "dev_name":      dev_name,
-                                "dev_bdaddr":    dev_bdaddr,
-                                "dev_flags":     dev_flags,
-                                "dev_flags_str": dev_flags_str})
+            device_list.append(
+                {
+                    "dev_id": dev_id,
+                    "dev_name": dev_name,
+                    "dev_bdaddr": dev_bdaddr,
+                    "dev_flags": dev_flags,
+                    "dev_flags_str": dev_flags_str,
+                }
+            )
         s.close()
-        return device_list
+        return cast("List[Device]", device_list)
 
     def bringHciDeviceUp(self, dev_id):
         """
@@ -112,24 +168,36 @@ class HCICore(InternalBlue):
             log.warn("Error returned by ioctl: %s" % str(e))
             return False
 
-
     def device_list(self):
         """
         Return a list of connected hci devices.
         """
-
+        if self.replay:
+            return [(self, "hci_replay", "hci: ReplaySocket")]
         device_list = []
         for dev in self.getHciDeviceList():
-            log.info("HCI device: %s  [%s]  flags=%d<%s>" %
-                    (dev["dev_name"], dev["dev_bdaddr"],
-                     dev["dev_flags"], dev["dev_flags_str"]))
-            device_list.append([self, dev["dev_name"], 'hci: %s (%s) <%s>' %
-                    (dev["dev_bdaddr"], dev["dev_name"], dev["dev_flags_str"])])
+            log.info(
+                "HCI device: %s  [%s]  flags=%d<%s>"
+                % (
+                    dev["dev_name"],
+                    dev["dev_bdaddr"],
+                    dev["dev_flags"],
+                    dev["dev_flags_str"],
+                )
+            )
+            device_list.append(
+                (
+                    self,
+                    dev["dev_name"],
+                    "hci: %s (%s) <%s>"
+                    % (dev["dev_bdaddr"], dev["dev_name"], dev["dev_flags_str"]),
+                )
+            )
 
         if len(device_list) == 0:
-            log.info('No connected HCI device found')
+            log.info("No connected HCI device found")
 
-        return device_list
+        return cast("List[Device]", device_list)
 
     def local_connect(self):
         """
@@ -138,7 +206,7 @@ class HCICore(InternalBlue):
         if not self.interface:
             log.warn("No HCI identifier is set")
             return False
-        
+
         if not self._setupSockets():
             log.critical("HCI socket could not be established!")
             return False
@@ -159,8 +227,10 @@ class HCICore(InternalBlue):
         this field as 0x00E03AB44A676000.
         """
         time_betw_0_and_2000_ad = int("0x00E03AB44A676000", 16)
-        time_since_2000_epoch = time - datetime.datetime(2000,1,1)
-        packed_time = time_since_2000_epoch + datetime.timedelta(microseconds=time_betw_0_and_2000_ad)
+        time_since_2000_epoch = time - datetime.datetime(2000, 1, 1)
+        packed_time = time_since_2000_epoch + datetime.timedelta(
+            microseconds=time_betw_0_and_2000_ad
+        )
         return int(packed_time.total_seconds() * 1000 * 1000)
 
     def _recvThreadFunc(self):
@@ -182,30 +252,49 @@ class HCICore(InternalBlue):
             # Read the record data
             try:
                 record_data = self.s_snoop.recv(1024)
+                record_data = bytearray(record_data)
             except socket.timeout:
-                continue # this is ok. just try again without error
-            except Exception:
-                log.critical("Lost device interface, terminating receive thread...")
+                continue  # this is ok. just try again without error
+            except Exception as e:
+                log.critical(
+                    "Lost device interface with exception {}, terminating receive thread...".format(
+                        e
+                    )
+                )
                 self.exit_requested = True
                 continue
 
             # btsnoop record header data:
             btsnoop_orig_len = len(record_data)
-            btsnoop_inc_len  = len(record_data)
-            btsnoop_flags    = 0
-            btsnoop_drops    = 0
-            btsnoop_time     = datetime.datetime.now()
+            btsnoop_inc_len = len(record_data)
+            btsnoop_flags = 0
+            btsnoop_drops = 0
+            btsnoop_time = datetime.datetime.now()
 
             # Put all relevant infos into a tuple. The HCI packet is parsed with the help of hci.py.
-            record = (hci.parse_hci_packet(record_data), btsnoop_orig_len, btsnoop_inc_len,
-                      btsnoop_flags, btsnoop_drops, btsnoop_time)
+            record = (
+                hci.parse_hci_packet(record_data),
+                btsnoop_orig_len,
+                btsnoop_inc_len,
+                btsnoop_flags,
+                btsnoop_drops,
+                btsnoop_time,
+            )
 
-            log.debug("_recvThreadFunc Recv: [" + str(btsnoop_time) + "] " + str(record[0]))
+            log.debug(
+                "_recvThreadFunc Recv: [" + str(btsnoop_time) + "] " + str(record[0])
+            )
 
             # Write to btsnoop file:
             if self.write_btsnooplog:
-                btsnoop_record_hdr = struct.pack(">IIIIq", btsnoop_orig_len, btsnoop_inc_len, btsnoop_flags,
-                                                    btsnoop_drops, self._btsnoop_pack_time(btsnoop_time))
+                btsnoop_record_hdr = struct.pack(
+                    ">IIIIq",
+                    btsnoop_orig_len,
+                    btsnoop_inc_len,
+                    btsnoop_flags,
+                    btsnoop_drops,
+                    self._btsnoop_pack_time(btsnoop_time),
+                )
                 with self.btsnooplog_file_lock:
                     self.btsnooplog_file.write(btsnoop_record_hdr)
                     self.btsnooplog_file.write(record_data)
@@ -214,11 +303,13 @@ class HCICore(InternalBlue):
             # Put the record into all queues of registeredHciRecvQueues if their
             # filter function matches.
             for queue, filter_function in self.registeredHciRecvQueues:
-                if filter_function == None or filter_function(record):
+                if filter_function is None or filter_function(record):
                     try:
                         queue.put(record, block=False)
-                    except Queue.Full:
-                        log.warn("recvThreadFunc: A recv queue is full. dropping packets..")
+                    except queue2k.Full:
+                        log.warn(
+                            "recvThreadFunc: A recv queue is full. dropping packets.."
+                        )
 
             # Call all callback functions inside registeredHciCallbacks and pass the
             # record as argument.
@@ -227,9 +318,9 @@ class HCICore(InternalBlue):
 
             # Check if the stackDumpReceiver has noticed that the chip crashed.
             # if self.stackDumpReceiver.stack_dump_has_happend:
-                # A stack dump has happend!
-                # log.warn("recvThreadFunc: The controller send a stack dump.")
-                # self.exit_requested = True
+            # A stack dump has happend!
+            # log.warn("recvThreadFunc: The controller send a stack dump.")
+            # self.exit_requested = True
 
         log.debug("Receive Thread terminated.")
 
@@ -240,7 +331,9 @@ class HCICore(InternalBlue):
         """
 
         # Check if hci device is in state "UP". If not, set it to "UP" (requires root)
-        device = [dev for dev in self.getHciDeviceList() if dev["dev_name"] == self.interface]
+        device = [
+            dev for dev in self.getHciDeviceList() if dev["dev_name"] == self.interface
+        ]
         if len(device) == 0:
             log.warn("Device not found: " + self.interface)
             return False
@@ -256,9 +349,11 @@ class HCICore(InternalBlue):
         # TODO unload btusb module and check error messages here to give the user some output if sth fails
 
         # Connect to HCI socket
-        self.s_snoop = socket.socket(socket.AF_BLUETOOTH, socket.SOCK_RAW, socket.BTPROTO_HCI)
-        self.s_snoop.setsockopt(socket.SOL_HCI, socket.HCI_DATA_DIR,1)
-        self.s_snoop.setsockopt(socket.SOL_HCI, socket.HCI_TIME_STAMP,1)
+        self.s_snoop = socket.socket(
+            socket.AF_BLUETOOTH, socket.SOCK_RAW, socket.BTPROTO_HCI
+        )
+        self.s_snoop.setsockopt(socket.SOL_HCI, socket.HCI_DATA_DIR, 1)
+        self.s_snoop.setsockopt(socket.SOL_HCI, socket.HCI_TIME_STAMP, 1)
         """
         struct hci_filter {
             uint32_t type_mask;     -> 4
@@ -267,11 +362,14 @@ class HCICore(InternalBlue):
         };
         """
         # TODO still seems to only forward incoming events?!
-        self.s_snoop.setsockopt(socket.SOL_HCI, socket.HCI_FILTER,
- '\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00') #type mask, event mask, event mask, opcode
+        self.s_snoop.setsockopt(
+            socket.SOL_HCI,
+            socket.HCI_FILTER,
+            b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00",
+        )  # type mask, event mask, event mask, opcode
 
         interface_num = device["dev_id"]
-        log.debug("Socket interface number: %s" % (interface_num))
+        log.debug("Socket interface number: %s" % interface_num)
         self.s_snoop.bind((interface_num,))
         self.s_snoop.settimeout(2)
         log.debug("_setupSockets: Bound socket.")
@@ -282,7 +380,9 @@ class HCICore(InternalBlue):
         # Write Header to btsnoop file (if file is still empty):
         if self.write_btsnooplog and self.btsnooplog_file.tell() == 0:
             # BT Snoop Header: btsnoop\x00, version: 1, data link type: 1002
-            btsnoop_hdr = "btsnoop\x00" + p32(1,endian="big") + p32(1002,endian="big")
+            btsnoop_hdr = (
+                b"btsnoop\x00" + p32(1, endian="big") + p32(1002, endian="big")
+            )
             with self.btsnooplog_file_lock:
                 self.btsnooplog_file.write(btsnoop_hdr)
                 self.btsnooplog_file.flush()
@@ -294,9 +394,9 @@ class HCICore(InternalBlue):
         Close s_snoop and s_inject socket. (equal)
         """
 
-        if (self.s_inject != None):
+        if self.s_inject is not None:
             self.s_inject.close()
             self.s_inject = None
-            self.s_snoop  = None
+            self.s_snoop = None
 
         return True

internalblue/ioscore.py

@@ -1,26 +1,41 @@
 #!/usr/bin/env python2
 
+from __future__ import absolute_import
+
+import struct
+
+from future import standard_library
+
+standard_library.install_aliases()
+from builtins import str
 import socket
-import Queue
-import hci
+import queue as queue2k
+from . import hci
 
-from pwn import *
+from internalblue.utils.pwnlib_wrapper import log, context
+
+from .usbmux import USBMux, MuxError
+from .core import InternalBlue
 
-from core import InternalBlue
 
 class iOSCore(InternalBlue):
+    buffer: bytes
 
-    def __init__(self, ios_addr, queue_size=1000, btsnooplog_filename='btsnoop.log', log_level='info', fix_binutils='True', data_directory="."):
-        super(iOSCore, self).__init__(queue_size, btsnooplog_filename, log_level, fix_binutils, data_directory=".")
-        parts = ios_addr.split(':')
-        if len(parts) != 2:
-            log.critical("iOS device address should be of format HOSTNAME:PORT")
-            exit(-1)
-        self.ios_addr = parts[0]
-        self.ios_port = parts[1]
+    def __init__(
+        self,
+        queue_size=1000,
+        btsnooplog_filename="btsnoop.log",
+        log_level="info",
+        fix_binutils="True",
+        data_directory=".",
+    ):
+        super(iOSCore, self).__init__(
+            queue_size, btsnooplog_filename, log_level, fix_binutils, data_directory="."
+        )
         self.serial = False
         self.doublecheck = True
-        self.buffer = ""
+        self.buffer = b""
+        self.mux = USBMux()
 
     def device_list(self):
         """
@@ -34,9 +49,21 @@ class iOSCore(InternalBlue):
             log.warn("Already running. Call shutdown() first!")
             return []
 
-        # assume that a explicitly specified iPhone exists
+        # because we need to call process for every device that is connected
+        # and we don't really know how much are connected, we just call process
+        # 8 times (which should be a reasonable limit for the amount of connected
+        # iOS devices) with a very short timeout.
+        for i in range(0, 8):
+            self.mux.process(0.01)
+
+        self.devices = self.mux.devices
+        if not self.devices:
+            log.info("No iOS devices connected")
+        
         device_list = []
-        device_list.append((self, "iPhone", "iPhone"))
+        for dev in self.devices:
+            dev_id = "iOS Device (" + dev.serial.decode("utf-8") + ")"
+            device_list.append((self, dev, dev_id))
 
         return device_list
 
@@ -49,16 +76,16 @@ class iOSCore(InternalBlue):
         the command or None if no response was received within the timeout.
         """
 
-        queue = Queue.Queue(1)
+        queue = queue2k.Queue(1)
 
         try:
             self.sendQueue.put((h4type, data, queue, None), timeout=timeout)
             ret = queue.get(timeout=timeout)
             return ret
-        except Queue.Empty:
+        except queue2k.Empty:
             log.warn("sendH4: waiting for response timed out!")
             return None
-        except Queue.Full:
+        except queue2k.Full:
             log.warn("sendH4: send queue is full!")
             return None
 
@@ -69,72 +96,87 @@ class iOSCore(InternalBlue):
         """
         if not self._setupSockets():
             log.critical("No connection to iPhone.")
-            log.info("Check if\n -> Bluetooth is deactivated in the iPhone settings\n -> internalblue-ios-proxy is running\n -> the proxied port is accesible from this machine")
+            log.info(
+                "Check if\n \
+                -> Bluetooth is deactivated in the iOS device's settings\n \
+                -> internalblued is installed on the device\n \
+                -> the device is connected to this computer via USB\n \
+                -> usbmuxd is installed on this computer"
+            )
             return False
         return True
 
     def _setupSockets(self):
         """
-        Connect to the iOS bluetooth device over internalblue-ios-proxy
+        Connect to the iOS Bluetooth device over usbmuxd and internalblued 
         """
 
-        self.s_inject = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
         try:
-            self.s_inject.connect((self.ios_addr, int(self.ios_port)))
-            self.s_inject.settimeout(0.5)
-        except socket.error:
-            log.warn("Could not connect to iPhone, is internalblue-ios-proxy running?")
+            self.s_inject = self.mux.connect(self.interface, 1234)
+        except MuxError:
+            log.warn("Could not connect to iOS proxy. Is internalblued running on the connected device?")
             return False
+        
+        self.s_inject.settimeout(0.5)
 
-        # with ios proxy the send and receive sockets are the same
+        # with on iOS the send and receive sockets are the same
         self.s_snoop = self.s_inject
 
+        # empty the socket (can sometimes still hold data if the previous execution
+        # of internalblue was cancelled or crashed)
+        try:
+            self.s_inject.recv(1024)
+        except socket.error:
+            pass
+
         return True
 
-    def _getLatestH4Blob(self, new_data=""):
-        data_out = ""
+    def _getLatestH4Blob(self, new_data: bytes = b""):
+        data_out: bytes = b""
         self.buffer += new_data
         if len(self.buffer) > 0:
-        
+
             # if the buffer is too small, wait for more data
             if len(self.buffer) < 5:
                 return (None, False)
             else:
-                #log.info(self.buffer[0].encode("hex"))
                 # for ACL data the length field is at offset 3
-                if self.buffer[0] == '\x02':
-                    acl_len = struct.unpack_from("h", self.buffer[3:])[0]
+                if self.buffer[0] == 0x2:
+                    acl_len = self.buffer[3]
                     required_len = acl_len + 5
                 # for HCI cmd data the length is at offset 3 (but just one byte)
-                elif self.buffer[0] == '\x01':
-                    hci_len = struct.unpack_from("b", self.buffer[3:])[0]
+                elif self.buffer[0] == 0x1:
+                    hci_len = self.buffer[3]
                     required_len = hci_len + 4
                 # for HCI event data the length is at offset 2 (one byte)
-                elif self.buffer[0] == '\x04':
-                    hci_len = struct.unpack_from("b", self.buffer[2:])[0]
+                elif self.buffer[0] == 0x4:
+                    hci_len = self.buffer[2]
                     required_len = hci_len + 3
                 # for BCM data the length should always be 64
-                elif self.buffer[0] == '\x07':
+                elif self.buffer[0] == 0x07:
                     required_len = 64
+                else:
+                    raise ValueError("Could not derive required_len from buffer")
 
                 # if we don't have all the data we need, we just wait for more
                 if len(self.buffer) < required_len:
-                    #log.info("Not enough data, expected %d, got %d", required_len, len(self.buffer))
                     return (None, False)
                 # might be the case that we have too much
                 elif len(self.buffer) > required_len:
-                    log.info("Got too much data, expected %d, got %d", required_len, len(self.buffer))
-                    surplus = len(self.buffer) - required_len 
-                    new_buffer = self.buffer[required_len:len(self.buffer)]
+                    log.info(
+                        "Got too much data, expected %d, got %d",
+                        required_len,
+                        len(self.buffer),
+                    )
+                    surplus = len(self.buffer) - required_len
+                    new_buffer = self.buffer[required_len : len(self.buffer)]
                     data_out = self.buffer[:-surplus]
-                    #log.info("new_buffer: %s, data_out: %s", new_buffer.encode("hex"), data_out.encode("hex"))
                     self.buffer = new_buffer
                     return (data_out, True)
                 # sometimes we even have just the right amout of data
                 else:
-                    #log.info("Got exactly the right amount of data")
                     data_out = self.buffer
-                    self.buffer = ""
+                    self.buffer = b""
                     return (data_out, False)
         else:
             return (None, False)
@@ -154,27 +196,31 @@ class iOSCore(InternalBlue):
             try:
                 received_data = self.s_snoop.recv(1024)
             except socket.timeout:
-                continue # this is ok. just try again without error
-                
-            # because the iOS socket is rather unreliable (blame the iOS proxy developer) we
-            # need to do some length checks and get the H4/HCI data in the right format
-            #log.info("H4 Data received")
-            #log.info(received_data.encode('hex'))
-            
+                continue  # this is ok. just try again without error
+
+            log.debug("H4 Data: %s", received_data)
+
             (record_data, is_more) = self._getLatestH4Blob(new_data=received_data)
             while record_data is not None:
                 # Put all relevant infos into a tuple. The HCI packet is parsed with the help of hci.py.
-                record = (hci.parse_hci_packet(record_data), 0, 0, 0, 0, 0) 
+                record = (hci.parse_hci_packet(record_data), 0, 0, 0, 0, 0)
 
                 log.debug("Recv: " + str(record[0]))
 
                 # Put the record into all queues of registeredHciRecvQueues if their
                 # filter function matches.
-                for queue, filter_function in self.registeredHciRecvQueues: # TODO filter_function not working with bluez modifications
+                for (
+                    queue,
+                    filter_function,
+                ) in (
+                    self.registeredHciRecvQueues
+                ):  # TODO filter_function not working with bluez modifications
                     try:
                         queue.put(record, block=False)
-                    except Queue.Full:
-                        log.warn("recvThreadFunc: A recv queue is full. dropping packets..")
+                    except queue2k.Full:
+                        log.warn(
+                            "recvThreadFunc: A recv queue is full. dropping packets.."
+                        )
 
                 # Call all callback functions inside registeredHciCallbacks and pass the
                 # record as argument.
@@ -184,9 +230,11 @@ class iOSCore(InternalBlue):
                 # Check if the stackDumpReceiver has noticed that the chip crashed.
                 if self.stackDumpReceiver.stack_dump_has_happend:
                     # A stack dump has happend!
-                    log.warn("recvThreadFunc: The controller send a stack dump. stopping..")
+                    log.warn(
+                        "recvThreadFunc: The controller send a stack dump. stopping.."
+                    )
                     self.exit_requested = True
-                
+
                 (record_data, is_more) = self._getLatestH4Blob()
                 if not is_more:
                     break
@@ -198,9 +246,8 @@ class iOSCore(InternalBlue):
         Close s_snoop and s_inject (which are the same)
         """
 
-        if (self.s_inject != None):
+        if self.s_inject is not None:
             self.s_inject.close()
             self.s_inject = None
 
         return True
-

internalblue/macoscore.py

@@ -1,30 +1,63 @@
 #!/usr/bin/env python2
 
+from __future__ import absolute_import
+
+import random
+import time
+
+from future import standard_library
+
+standard_library.install_aliases()
+from builtins import str
 import socket
-import Queue
-import hci
+import queue as queue2k
+from . import hci
 
-from pwn import *
 
-from core import InternalBlue
+from internalblue.utils.pwnlib_wrapper import log, context, p8
+from .core import InternalBlue
 
-import objc
 import binascii
 import os
+
 filepath = os.path.dirname(os.path.abspath(__file__))
 
-objc.initFrameworkWrapper("IOBluetoothExtended",
-    frameworkIdentifier="de.tu-darmstadt.seemoo.IOBluetoothExtended",
-    frameworkPath=objc.pathForFramework(filepath+"/../macos-framework/IOBluetoothExtended.framework"),
-    globals=globals())
+IOBE = None
+
 
 class macOSCore(InternalBlue):
-    NSNotificationCenter = objc.lookUpClass('NSNotificationCenter')
-
-    def __init__(self, queue_size=1000, btsnooplog_filename='btsnoop.log', log_level='info', fix_binutils='True', data_directory="."):
-        super(macOSCore, self).__init__(queue_size, btsnooplog_filename, log_level, fix_binutils, data_directory=".")
+    def __init__(
+        self,
+        queue_size=1000,
+        btsnooplog_filename="btsnoop.log",
+        log_level="info",
+        fix_binutils="True",
+        data_directory=".",
+        replay=False,
+    ):
+        super(macOSCore, self).__init__(
+            queue_size,
+            btsnooplog_filename,
+            log_level,
+            fix_binutils,
+            data_directory=".",
+            replay=replay,
+        )
         self.doublecheck = False
         self.iobe = None
+        self.serial = None
+        if not replay:
+            import objc  # type: ignore
+
+            objc.initFrameworkWrapper(
+                "IOBluetoothExtended",
+                frameworkIdentifier="de.tu-darmstadt.seemoo.IOBluetoothExtended",
+                frameworkPath=objc.pathForFramework(
+                    filepath + "/../macos-framework/IOBluetoothExtended.framework"
+                ),
+                globals=globals(),
+            )
+        self.hciport = -1
 
     def device_list(self):
         """
@@ -43,28 +76,6 @@ class macOSCore(InternalBlue):
 
         return device_list
 
-    def sendH4(self, h4type, data, timeout=2):
-        """
-        Send an arbitrary HCI packet by pushing a send-task into the
-        sendQueue. This function blocks until the response is received
-        or the timeout expires. The return value is the Payload of the
-        HCI Command Complete Event which was received in response to
-        the command or None if no response was received within the timeout.
-        """
-
-        queue = Queue.Queue(1)
-
-        try:
-            self.sendQueue.put((h4type, data, queue, None), timeout=timeout)
-            ret = queue.get(timeout=timeout)
-            return ret
-        except Queue.Empty:
-            log.warn("sendH4: waiting for response timed out!")
-            return None
-        except Queue.Full:
-            log.warn("sendH4: send queue is full!")
-            return None
-
     def local_connect(self):
         if not self._setupSockets():
             log.critical("No connection to target device.")
@@ -72,14 +83,20 @@ class macOSCore(InternalBlue):
         return True
 
     def _setupSockets(self):
-        self.hciport = random.randint(60000, 65535-1)
-        log.debug("_setupSockets: Selected random ports snoop=%d and inject=%d" % (self.hciport, self.hciport + 1))
-        log.info("Wireshark configuration (on Loopback interface): udp.port == %d || udp.port == %d" % (self.hciport, self.hciport + 1))
+        self.hciport = random.randint(60000, 65535 - 1)
+        log.debug(
+            "_setupSockets: Selected random ports snoop=%d and inject=%d"
+            % (self.hciport, self.hciport + 1)
+        )
+        log.info(
+            "Wireshark configuration (on Loopback interface): udp.port == %d || udp.port == %d"
+            % (self.hciport, self.hciport + 1)
+        )
 
         # Create s_snoop socket
         self.s_snoop = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
         self.s_snoop.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-        self.s_snoop.bind(('127.0.0.1', self.hciport))
+        self.s_snoop.bind(("127.0.0.1", self.hciport))
         self.s_snoop.settimeout(0.5)
         self.s_snoop.setblocking(True)
 
@@ -90,7 +107,12 @@ class macOSCore(InternalBlue):
 
         # Create IOBluetoothExtended Object that listens for commands,
         # sends them to the Bluetooth chip and replies via UDP socket.
-        self.iobe = IOBE.alloc().initWith_and_(str(self.hciport+1), str(self.hciport))
+        if not self.replay:
+            self.iobe = IOBE.alloc().initWith_and_(
+                str(self.hciport + 1), str(self.hciport)
+            )
+        else:
+            self.iobe = None
         time.sleep(0.5)
 
         return True
@@ -106,23 +128,37 @@ class macOSCore(InternalBlue):
             # read record data
             try:
                 data, addr = self.s_snoop.recvfrom(1024)
-                record_data = data
+                record_data = bytearray(data)
             except socket.timeout:
-                continue # this is ok. just try again without error
+                continue  # this is ok. just try again without error
 
             if not self.exit_requested:
                 # Put all relevant infos into a tuple. The HCI packet is parsed with the help of hci.py.
-                record = (hci.parse_hci_packet(record_data), 0, 0, 0, 0, 0) #TODO not sure if this causes trouble?
+                record = (
+                    hci.parse_hci_packet(record_data),
+                    0,
+                    0,
+                    0,
+                    0,
+                    0,
+                )  # TODO not sure if this causes trouble?
                 log.debug("Recv: " + str(record[0]))
-                log.info(binascii.hexlify(record_data))
 
                 # Put the record into all queues of registeredHciRecvQueues if their
                 # filter function matches.
-                for queue, filter_function in self.registeredHciRecvQueues: # TODO filter_function not working with bluez modifications
+                for (
+                    queue,
+                    filter_function,
+                ) in (
+                    self.registeredHciRecvQueues
+                ):  # TODO filter_function not working with bluez modifications
                     try:
                         queue.put(record, block=False)
-                    except Queue.Full:
-                        log.warn("recvThreadFunc: A recv queue is full. dropping packets..>" + record_data)
+                    except queue.Full:
+                        log.warn(
+                            "recvThreadFunc: A recv queue is full. dropping packets..>"
+                            + str(record_data)
+                        )
 
                 # Call all callback functions inside registeredHciCallbacks and pass the
                 # record as argument.
@@ -140,7 +176,7 @@ class macOSCore(InternalBlue):
             # Wait for 'send task' in send queue
             try:
                 task = self.sendQueue.get(timeout=0.5)
-            except Queue.Empty:
+            except queue2k.Empty:
                 continue
 
             # Extract the components of the task
@@ -151,16 +187,29 @@ class macOSCore(InternalBlue):
 
             # Send command to the chip using IOBluetoothExtended framework
             h4type, data, queue, filter_function = task
-            opcode = binascii.hexlify(data[1]) + binascii.hexlify(data[0])
-            log.debug("Sending command: 0x" + binascii.hexlify(data) + ", opcode: " + opcode)
+            data = bytearray(data)
+            opcode = format(data[1], "02x") + format(data[0], "02x")
+
+            log.debug(
+                "Sending command: 0x"
+                + "".join(format(x, "02x") for x in data)
+                + ", opcode: "
+                + opcode
+            )
+
+            if not (h4type == 0x01 or h4type == 0x02):
+                log.warn("H4 Type {0} not supported by macOS Core!".format(str(h4type)))
+                if queue is not None:
+                    queue.put(None)
+                continue
 
             # if the caller expects a response: register a queue to receive the response
             if queue is not None and filter_function is not None:
-                recvQueue = Queue.Queue(1)
+                recvQueue = queue2k.Queue(1)
                 self.registerHciRecvQueue(recvQueue, filter_function)
 
             # Sending command
-            self.s_inject.sendto(out, ('127.0.0.1', self.hciport+1))
+            self.s_inject.sendto(out, ("127.0.0.1", self.hciport + 1))
 
             # if the caller expects a response:
             # Wait for the HCI event response by polling the recvQueue
@@ -168,8 +217,8 @@ class macOSCore(InternalBlue):
                 try:
                     record = recvQueue.get(timeout=10)
                     hcipkt = record[0]
-                    data   = hcipkt.data
-                except Queue.Empty:
+                    data = hcipkt.data
+                except queue2k.Empty:
                     log.warn("_sendThreadFunc: No response from the firmware.")
                     data = None
                     self.unregisterHciRecvQueue(recvQueue)
@@ -180,9 +229,6 @@ class macOSCore(InternalBlue):
 
         log.debug("Send Thread terminated.")
 
-    def enableBroadcomDiagnosticLogging(self, enable):
-        return
-
     def _teardownSockets(self):
         if self.s_inject is not None:
             self.s_inject.close()
@@ -195,7 +241,7 @@ class macOSCore(InternalBlue):
         return True
 
     def shutdown(self):
-        self.iobe.shutdown()
-        socket.socket(socket.AF_INET, socket.SOCK_DGRAM).sendto(
-        "", ('127.0.0.1', self.s_snoop.getsockname()[1]))
+        if not self.replay:
+            self.iobe.shutdown()
+        self.s_inject.sendto(b"", ("127.0.0.1", self.s_snoop.getsockname()[1]))
         super(macOSCore, self).shutdown()

internalblue/objects/connection_information.py

@@ -0,0 +1,86 @@
+from builtins import object
+from internalblue.utils.pwnlib_wrapper import u32, u16, u8
+from typing import Any
+
+
+class ConnectionInformation(object):
+    connection_handle = 0
+    connection_number = 0
+    master_of_connection = False
+    remote_name_address = 0
+    remote_address = None
+    id: bytearray
+    public_rand = None
+    extended_lmp_feat = None
+    link_key = None
+    tx_pwr_lvl_dBm = 0
+    effective_key_len = 0
+    host_supported_feat = None
+
+    def __init__(
+        self,
+        connection_number,
+        remote_address,
+        remote_name_address,
+        master_of_connection,
+        connection_handle,
+        public_rand,
+        effective_key_len,
+        link_key,
+        tx_pwr_lvl_dBm,
+        extended_lmp_feat,
+        host_supported_feat,
+        id,
+    ):
+        self.connection_number = connection_number
+        self.remote_address = remote_address
+        self.remote_name_address = remote_name_address
+        self.master_of_connection = master_of_connection
+        self.connection_handle = connection_handle
+        self.public_rand = public_rand
+        self.effective_key_len = effective_key_len
+        self.link_key = link_key
+        self.tx_pwr_lvl_dBm = tx_pwr_lvl_dBm
+        self.extended_lmp_feat = extended_lmp_feat
+        self.host_supported_feat = host_supported_feat
+        self.id = id
+
+    @staticmethod
+    def from_connection_buffer(connection):
+
+        # Possible TODO: Convert this to a Katai Struct parser with a proper .ksy grammar.
+        return ConnectionInformation(
+            u32(connection[:4]),
+            connection[0x28:0x2E][::-1],
+            u32(connection[0x4C:0x50]),
+            u32(connection[0x1C:0x20]) & 1 << 15 == 0,
+            u16(connection[0x64:0x66]),
+            connection[0x78:0x88],
+            u8(connection[0xA7:0xA8]),
+            connection[0x68 : 0x68 + u8(connection[0xA7:0xA8])],
+            u8(connection[0x9C:0x9D]) - 127,
+            connection[0x30:0x38],
+            connection[0x38:0x40],
+            connection[0x0C:0x0D],
+        )
+        # For some reason the following doesn't work because some attributes like link_key end up as one element tuples
+        # connection_number = u32(connection[:4])
+        # remote_address = connection[0x28:0x2E][::-1],
+        # remote_name_address = u32(connection[0x4C:0x50])
+        # master_of_connection = u32(connection[0x1C:0x20]) & 1 << 15 == 0
+        # connection_handle = u16(connection[0x64:0x66])
+        # public_rand = connection[0x78:0x88]
+        # effective_key_len = u8(connection[0xa7:0xa8])
+        # link_key = connection[0x68:0x68 + effective_key_len],
+        # tx_pwr_lvl_dBm = u8(connection[0x9c:0x9d]) - 127,
+        # extended_lmp_feat = connection[0x30:0x38]
+        # host_supported_feat = connection[0x38:0x40]
+        # id = connection[0x0c:0x0d]
+        # return ConnectionInformation(connection_number, remote_address, remote_name_address, master_of_connection,
+        #                              connection_handle,
+        #                              public_rand, effective_key_len, link_key, tx_pwr_lvl_dBm, extended_lmp_feat,
+        #                              host_supported_feat, id)
+
+    def __getitem__(self, item):
+        # type: (str) -> Any
+        return vars(self)[item]

internalblue/objects/queue_element.py

@@ -0,0 +1,58 @@
+from builtins import object
+from typing import Any
+
+
+class QueueElement(object):
+    index = 0
+    next_item = 0
+    prev = 0
+    capacity = 0
+    name = ""
+    queue_buf_start = 0
+    available_items = 0
+    item_size = 0
+    next_free_slot = 0
+    free_slots = 0
+    address = 0
+    waitlist_length = 0
+    next = 0
+    queue_buf_end = 0
+    thread_waitlist = 0
+
+    def __init__(
+        self,
+        index,
+        address,
+        item_size,
+        capacity,
+        available_items,
+        free_slots,
+        queue_buf_start,
+        queue_buf_end,
+        next_item,
+        next_free_slot,
+        thread_waitlist,
+        waitlist_length,
+        next,
+        prev,
+        name,
+    ):
+        self.index = index
+        self.next_item = next_item
+        self.prev = prev
+        self.capacity = capacity
+        self.name = name
+        self.queue_buf_start = queue_buf_start
+        self.available_items = available_items
+        self.item_size = item_size
+        self.next_free_slot = next_free_slot
+        self.free_slots = free_slots
+        self.address = address
+        self.waitlist_length = waitlist_length
+        self.next = next
+        self.queue_buf_end = queue_buf_end
+        self.thread_waitlist = thread_waitlist
+
+    def __getitem__(self, item):
+        # type: (str) -> Any
+        return vars(self)[item]

internalblue/socket_hooks.py

@@ -0,0 +1,308 @@
+from __future__ import print_function
+from builtins import object
+import binascii
+import time
+
+
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple, Dict, Type
+except ImportError:
+    pass
+
+
+class SocketRecvHook(object):
+    def __init__(self, socket):
+        # type: (socket.socket) -> None
+        self.snoop_socket = socket
+        self.replace = False
+
+    def recv_hook(self, data):
+        raise NotImplementedError("recv_hook not implemented")
+
+    def recv_replace(self, length, **kwargs):
+        raise NotImplementedError("recv_replace not implemented")
+
+    def recv(self, length, **kwargs):
+        if not self.replace:
+            data = self.snoop_socket.recv(length, **kwargs)
+        else:
+            data = self.recv_replace(length, **kwargs)
+        self.recv_hook(data)
+        return data
+
+    def recvfrom_replace(self, length, **kwargs):
+        raise NotImplementedError("recvfrom_replace not implemented")
+
+    def recvfrom_hook(self, data, addr):
+        raise NotImplementedError("recvfrom_hook not implemented")
+
+    def recvfrom(self, length, **kwargs):
+        # type: (int, Dict[str, Any]) -> Tuple[bytes, Any]
+        if not self.replace:
+            data, addr = self.snoop_socket.recvfrom(length)
+        else:
+            data, addr = self.recvfrom_replace(length, **kwargs)
+        self.recvfrom_hook(data, addr)
+        return data, addr
+
+
+class SocketInjectHook(object):
+    def __init__(self, socket, core):
+        # type: (socket.socket, InternalBlue) -> None
+        self.inject_socket = socket
+        self.replace = False
+        self.core = core  # type: InternalBlue
+
+    def close(self):
+        if self.inject_socket:
+            self.inject_socket.close()
+
+    def send(self, data):
+        self.send_hook(data)
+        if not self.replace:
+            try:
+                self.inject_socket.send(data)
+            except Exception as e:
+                self.send_exception(e)
+                self.core.test_failed = e
+                raise
+        else:
+            try:
+                self.send_replace(data)
+            except Exception as e:
+                self.core.test_failed = e
+                raise
+
+    def sendto(self, data, socket):
+        self.sendto_hook(data, socket)
+        if not self.replace:
+            try:
+                self.inject_socket.sendto(data, socket)
+            except Exception as e:
+                self.send_exception(e)
+                self.core.test_failed = e
+                raise
+        else:
+            try:
+                self.send_replace(data)
+            except Exception as e:
+                self.core.test_failed = e
+                raise
+
+    def getsockname(self):
+        return self.snoop_socket.getsockname()
+
+    def send_hook(self, result):
+        raise NotImplementedError("send_hook not implemented")
+
+    def sendto_hook(self, data, socket):
+        raise NotImplementedError("sendto_hook not implemented")
+
+    def send_replace(self, data):
+        raise NotImplementedError("send_replace not implemented")
+
+    def send_exception(self, e):
+        raise NotImplementedError("send_exception not implemented")
+
+
+class SocketDuplexHook(SocketInjectHook, SocketRecvHook):
+    def __init__(self, snoop_socket, inject_socket, core, **kwargs):
+        # type: (socket.socket, socket.socket, InternalBlue, Dict[str, Any]) -> None
+        self.snoop_socket = snoop_socket
+        self.inject_socket = inject_socket
+        self.replace = False
+        self.core = core
+
+    pass
+
+
+class HookBase(object):
+    def send_hook(self, data):
+        raise NotImplementedError
+
+    def recv_hook(self, data):
+        raise NotImplementedError
+
+
+class TraceToFileHook(SocketDuplexHook):
+    def __init__(self, snoop_socket, inject_socket, core, filename="/tmp/bt_hci.log"):
+        # type: (socket.socket, socket.socket, InternalBlue, str) -> None
+        SocketDuplexHook.__init__(self, snoop_socket, inject_socket, core)
+        self.file = open(filename, "a")
+        self.replace = False
+        self.log = []
+        self.closed = False
+
+    def recv_hook(self, data):
+        line = "RX {}\n".format(binascii.hexlify(data))
+        print(line)
+        self.log.append(line)
+
+    def send_hook(self, data):
+        line = "TX {}\n".format(binascii.hexlify(data))
+        print(line)
+        self.log.append(line)
+
+    def recvfrom_hook(self, data, socket, **kwargs):
+        line = "RX {}\n".format(binascii.hexlify(data))
+        print(line)
+        self.log.append(line)
+
+    def sendto_hook(self, data, socket, **kwargs):
+        line = "TX {}\n".format(binascii.hexlify(data))
+        print(line)
+        self.log.append(line)
+
+    def send_exception(self, e):
+        line = "EX '{}'\n".format(e)
+        print(line)
+        self.log.append(line)
+
+    def close(self):
+        if not self.closed:
+            self.inject_socket.close()
+            self.snoop_socket.close()
+            self.log.append("Socket closed\n")
+            self.file.writelines(self.log)
+            self.file.close()
+            self.closed = True
+
+
+import socket
+
+
+class PrintTrace(SocketDuplexHook):
+    def send_hook(self, data, **kwargs):
+        print("Sent: {}".format(binascii.hexlify(data)))
+
+    def recv_hook(self, data, **kwargs):
+        print("Recv: {}".format(binascii.hexlify(data)))
+
+    def recvfrom_hook(self, data, addr, **kwargs):
+        print("Recv: {}".format(binascii.hexlify(data)))
+
+    def sendto_hook(self, data, socket, **kwargs):
+        print("Sent: {}".format(binascii.hexlify(data)))
+
+    def send_exception(self, e):
+        print("Exception: {}".format(e))
+
+
+class ReplaySocket(SocketDuplexHook):
+    def __init__(
+        self, snoop_socket, inject_socket, core, filename="/tmp/bt_hci.log", debug=False
+    ):
+        SocketDuplexHook.__init__(self, snoop_socket, inject_socket, core)
+        self.replace = True
+        with open(filename) as f:
+            self.log = f.readlines()
+        self.index = 0
+        self.debug = debug
+        if self.log[0].startswith("#"):
+            self.index = 1
+
+    def send_hook(self, data, **kwargs):
+        if self.debug:
+            print("Sent: {}".format(binascii.hexlify(data)))
+
+    def recv_hook(self, data, **kwargs):
+        if self.debug:
+            print("Recv: {}".format(binascii.hexlify(data)))
+
+    def recvfrom_hook(self, data, addr, **kwargs):
+        if self.debug:
+            print("Recv: {}".format(binascii.hexlify(data)))
+
+    def sendto_hook(self, data, socket, **kwargs):
+        if self.debug:
+            print("Sent: {}".format(binascii.hexlify(data)))
+
+    def send_exception(self, e):
+        if self.debug:
+            print("Exception: {}".format(e))
+
+    def send_replace(self, data, **kwargs):
+        encoded_data = ""  # type: str
+        hex_data = binascii.hexlify(data)
+        direction, encoded_data = self.log[self.index].split(" ", 1)
+        if direction == "RX":
+            # Some recieves aren't handled yet, wait a bit so the recv thread takes care of them.
+            time.sleep(0.2)
+            direction, encoded_data = self.log[self.index].split(" ", 1)
+        assert direction == "TX"
+        log_data = binascii.unhexlify(encoded_data.rstrip("\n"))
+        assert data == log_data, "Got {}, expected {}".format(hex_data, encoded_data)
+        self.index += 1
+        ty, data = self.log[self.index].split(" ", 1)
+        if ty == "EX":
+            self.index += 1
+            raise socket.error(data)
+
+    def recv_replace(self, length, **kwargs):
+        time.sleep(0.001)
+        direction, encoded_data = self.log[self.index].split(" ", 1)
+        if direction == "RX":
+            self.index += 1
+            return binascii.unhexlify(encoded_data.rstrip("\n"))
+        else:
+            raise socket.timeout()
+
+    def recvfrom_replace(self, length, **kwargs):
+        time.sleep(0.001)
+        direction, encoded_data = self.log[self.index].split(" ", 1)
+        if direction == "RX":
+            self.index += 1
+            return binascii.unhexlify(encoded_data.rstrip("\n")), 1234
+        else:
+            raise socket.timeout()
+
+    def getsockname(self):
+        return (None, 0)
+
+    def close(self):
+        assert self.index + 1 == len(self.log)
+
+
+from internalblue.core import InternalBlue
+
+
+def hook(core, socket_hook, **hookkwargs):
+    # type: (Type[InternalBlue], Type[SocketDuplexHook], Any) -> None
+
+    def wrap_socket_setup(orig_func):
+        def wrapped_socket_setup(self, *args, **kwargs):
+            if not self.replay:
+                status = orig_func(self, *args, **kwargs)
+            else:
+                status = True
+            h = socket_hook(self.s_snoop, self.s_inject, core=self, **hookkwargs)
+            self.s_inject = h
+            self.s_snoop = h
+            return status
+
+        return wrapped_socket_setup
+
+    core._setupSockets = wrap_socket_setup(core._setupSockets)
+
+    def wrap_teardown_sockets(orig_func):
+        def wrapped_teardown_sockets(self, *args, **kwargs):
+            if not self.replay:
+                return orig_func(self, *args, **kwargs)
+            else:
+                self.s_inject.close()
+                self.s_snoop.close()
+
+        return wrapped_teardown_sockets
+
+    core._teardownSockets = wrap_teardown_sockets(core._teardownSockets)
+
+    def wrap_device_list(orig_func):
+        def wrapped_device_list(self, *args, **kwargs):
+            if not self.replay:
+                return orig_func(self, *args, **kwargs)
+            else:
+                return [(self, "ReplayDevice", "ReplayDevice")]
+
+        return wrapped_device_list
+
+    core.device_list = wrap_device_list(core.device_list)

internalblue/usbmux.py

@@ -0,0 +1,242 @@
+#
+#	usbmux.py - usbmux client library for Python
+#
+# Copyright (C) 2009	Hector Martin "marcan" <hector@marcansoft.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 2 or version 3.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+import socket, struct, select, sys
+
+try:
+    import plistlib
+    haveplist = True
+except:
+    haveplist = False
+
+class MuxError(Exception):
+    pass
+
+class MuxVersionError(MuxError):
+    pass
+
+class SafeStreamSocket:
+    def __init__(self, address, family):
+        self.sock = socket.socket(family, socket.SOCK_STREAM)
+        self.sock.connect(address)
+    def send(self, msg):
+        totalsent = 0
+        while totalsent < len(msg):
+            sent = self.sock.send(msg[totalsent:])
+            if sent == 0:
+                raise MuxError("socket connection broken")
+            totalsent = totalsent + sent
+    def recv(self, size):
+        msg = b''
+        while len(msg) < size:
+            chunk = self.sock.recv(size-len(msg))
+            if chunk == b'':
+                raise MuxError("socket connection broken")
+            msg = msg + chunk
+        return msg
+
+class MuxDevice(object):
+    def __init__(self, devid, usbprod, serial, location):
+        self.devid = devid
+        self.usbprod = usbprod
+        self.serial = serial
+        self.location = location
+    def __str__(self):
+        return "<MuxDevice: ID %d ProdID 0x%04x Serial '%s' Location 0x%x>"%(self.devid, self.usbprod, self.serial, self.location)
+
+class BinaryProtocol(object):
+    TYPE_RESULT = 1
+    TYPE_CONNECT = 2
+    TYPE_LISTEN = 3
+    TYPE_DEVICE_ADD = 4
+    TYPE_DEVICE_REMOVE = 5
+    VERSION = 0
+    def __init__(self, socket):
+        self.socket = socket
+        self.connected = False
+
+    def _pack(self, req, payload):
+        if req == self.TYPE_CONNECT:
+            return struct.pack("IH", payload['DeviceID'], payload['PortNumber']) + b'\x00\x00'
+        elif req == self.TYPE_LISTEN:
+            return b""
+        else:
+            raise ValueError("Invalid outgoing request type %d"%req)
+
+    def _unpack(self, resp, payload):
+        if resp == self.TYPE_RESULT:
+            return {'Number':struct.unpack("I", payload)[0]}
+        elif resp == self.TYPE_DEVICE_ADD:
+            devid, usbpid, serial, pad, location = struct.unpack("IH256sHI", payload)
+            serial = serial.split(b'\00')[0]
+            return {'DeviceID': devid, 'Properties': {'LocationID': location, 'SerialNumber': serial, 'ProductID': usbpid}}
+        elif resp == self.TYPE_DEVICE_REMOVE:
+            devid = struct.unpack("I", payload)[0]
+            return {'DeviceID': devid}
+        else:
+            raise MuxError("Invalid incoming request type %d"%req)
+
+    def sendpacket(self, req, tag, payload={}):
+        payload = self._pack(req, payload)
+        if self.connected:
+            raise MuxError("Mux is connected, cannot issue control packets")
+        length = 16 + len(payload)
+        data = struct.pack("IIII", length, self.VERSION, req, tag) + payload
+        self.socket.send(data)
+    def getpacket(self):
+        if self.connected:
+            raise MuxError("Mux is connected, cannot issue control packets")
+        dlen = self.socket.recv(4)
+        dlen = struct.unpack("I", dlen)[0]
+        body = self.socket.recv(dlen - 4)
+        version, resp, tag = struct.unpack("III",body[:0xc])
+        if version != self.VERSION:
+            raise MuxVersionError("Version mismatch: expected %d, got %d"%(self.VERSION,version))
+        payload = self._unpack(resp, body[0xc:])
+        return (resp, tag, payload)
+
+class PlistProtocol(BinaryProtocol):
+    TYPE_RESULT = "Result"
+    TYPE_CONNECT = "Connect"
+    TYPE_LISTEN = "Listen"
+    TYPE_DEVICE_ADD = "Attached"
+    TYPE_DEVICE_REMOVE = "Detached" #???
+    TYPE_PLIST = 8
+    VERSION = 1
+    def __init__(self, socket):
+        if not haveplist:
+            raise Exception("You need the plistlib module")
+        BinaryProtocol.__init__(self, socket)
+
+    def _pack(self, req, payload):
+        return payload
+
+    def _unpack(self, resp, payload):
+        return payload
+
+    def sendpacket(self, req, tag, payload={}):
+        payload['ClientVersionString'] = 'usbmux.py by marcan'
+        if isinstance(req, int):
+            req = [self.TYPE_CONNECT, self.TYPE_LISTEN][req-2]
+        payload['MessageType'] = req
+        payload['ProgName'] = 'tcprelay'
+        BinaryProtocol.sendpacket(self, self.TYPE_PLIST, tag, plistlib.dumps(payload))
+    def getpacket(self):
+        resp, tag, payload = BinaryProtocol.getpacket(self)
+        if resp != self.TYPE_PLIST:
+            raise MuxError("Received non-plist type %d"%resp)
+        payload = plistlib.loads(payload)
+        return payload['MessageType'], tag, payload
+
+class MuxConnection(object):
+    def __init__(self, socketpath, protoclass):
+        self.socketpath = socketpath
+        if sys.platform in ['win32', 'cygwin']:
+            family = socket.AF_INET
+            address = ('127.0.0.1', 27015)
+        else:
+            family = socket.AF_UNIX
+            address = self.socketpath
+        self.socket = SafeStreamSocket(address, family)
+        self.proto = protoclass(self.socket)
+        self.pkttag = 1
+        self.devices = []
+
+    def _getreply(self):
+        while True:
+            resp, tag, data = self.proto.getpacket()
+            if resp == self.proto.TYPE_RESULT:
+                return tag, data
+            else:
+                raise MuxError("Invalid packet type received: %d"%resp)
+    def _processpacket(self):
+        resp, tag, data = self.proto.getpacket()
+        if resp == self.proto.TYPE_DEVICE_ADD:
+            # BinaryProtocol returns bytearrays, PlistProtocol returns strings
+            # we convert this here and leave the protocols untouched
+            if self.proto.VERSION == 1:
+                # yeah, no recursion here, we know our dictionary
+                for k in data['Properties']:
+                    v = data['Properties'][k]
+                    if isinstance(v, str):
+                        data['Properties'][k] = v.encode("utf-8")
+
+            self.devices.append(MuxDevice(data['DeviceID'], data['Properties']['ProductID'], data['Properties']['SerialNumber'], data['Properties']['LocationID']))
+        elif resp == self.proto.TYPE_DEVICE_REMOVE:
+            for dev in self.devices:
+                if dev.devid == data['DeviceID']:
+                    self.devices.remove(dev)
+        elif resp == self.proto.TYPE_RESULT:
+            raise MuxError("Unexpected result: %d"%resp)
+        else:
+            raise MuxError("Invalid packet type received: %d"%resp)
+    def _exchange(self, req, payload={}):
+        mytag = self.pkttag
+        self.pkttag += 1
+        self.proto.sendpacket(req, mytag, payload)
+        recvtag, data = self._getreply()
+        if recvtag != mytag:
+            raise MuxError("Reply tag mismatch: expected %d, got %d"%(mytag, recvtag))
+        return data['Number']
+
+    def listen(self):
+        ret = self._exchange(self.proto.TYPE_LISTEN)
+        if ret != 0:
+            raise MuxError("Listen failed: error %d"%ret)
+    def process(self, timeout=None):
+        if self.proto.connected:
+            raise MuxError("Socket is connected, cannot process listener events")
+        rlo, wlo, xlo = select.select([self.socket.sock], [], [self.socket.sock], timeout)
+        if xlo:
+            self.socket.sock.close()
+            raise MuxError("Exception in listener socket")
+        if rlo:
+            self._processpacket()
+    def connect(self, device, port):
+        ret = self._exchange(self.proto.TYPE_CONNECT, {'DeviceID':device.devid, 'PortNumber':((port<<8) & 0xFF00) | (port>>8)})
+        if ret != 0:
+            raise MuxError("Connect failed: error %d"%ret)
+        self.proto.connected = True
+        return self.socket.sock
+    def close(self):
+        self.socket.sock.close()
+
+class USBMux(object):
+    def __init__(self, socketpath=None):
+        if socketpath is None:
+            if sys.platform == 'darwin':
+                socketpath = "/var/run/usbmuxd"
+            else:
+                socketpath = "/var/run/usbmuxd"
+        self.socketpath = socketpath
+        self.listener = MuxConnection(socketpath, BinaryProtocol)
+        try:
+            self.listener.listen()
+            self.version = 0
+            self.protoclass = BinaryProtocol
+        except MuxVersionError:
+            self.listener = MuxConnection(socketpath, PlistProtocol)
+            self.listener.listen()
+            self.protoclass = PlistProtocol
+            self.version = 1
+        self.devices = self.listener.devices
+    def process(self, timeout=None):
+        self.listener.process(timeout)
+    def connect(self, device, port):
+        connector = MuxConnection(self.socketpath, self.protoclass)
+        return connector.connect(device, port)

internalblue/utils/__init__.py

@@ -0,0 +1,7 @@
+# from pwnlib.util.packing import *
+from typing import Union
+
+
+def bytes_to_hex(bytes):
+    # type: (Union[bytes, bytearray]) -> str
+    return "".join(format(x, "02x") for x in bytearray(bytes))

internalblue/utils/pwnlib_wrapper.py

@@ -0,0 +1,95 @@
+"""
+The following proxies various utilities from pwnlibs by explicitly importing them
+To replace a "from pwn import *" remove it and let your IDE highlight all missing methods (Hint: F2 in PyCharm goes to next error)
+import the missing (and only the missing!) methods from this module, e.g. with "from internalblue.utils import term, read, log, text, options"
+In some cases like "from pwn import socket" this just imports another module.
+Use an IPython shell to run "from pwn import *" and check where some method/module actually comes from and either import it directly or add it to this module
+"""
+
+
+# Imports that used to be imported via 'from pwn import *'
+import pwnlib
+from pwnlib import term
+from pwnlib.util import iters
+from pwnlib.util.misc import read
+from pwnlib.context import context
+
+# TODO: Logging via pwnlib doesn't work yet, so for now it is still used via pwn
+# import pwnlib.log
+# pwnlib.log.install_default_handler()
+# log = pwnlib.log.getLogger('internalbue')
+
+from pwn import log
+
+
+from pwnlib.term import text
+from pwnlib.ui import options, yesno
+from pwnlib.util.packing import flat
+from pwnlib.asm import disasm
+from pwnlib.util.fiddling import isprint, unbits, bits_str, bits
+
+
+"""
+The packers like u8 are generated in a fairly convoluted way that breaks IDE introspection.
+The following code remedies this by:
+- Explicitly defining a stub function with type annotations
+- Generating all the packers like pwnlibs would
+- Only if if the current module already has the name of the packer as an attribute (i.e. has a stub function defined) it will be replaced with the pwnlibs version
+
+This means:
+- All import issues in the rest of the code are genuine as the imports are only available if an explicit stub function is added
+- The functions can be easily replaced by just implementing them and removing the for loop at the end
+
+"""
+
+# Imports needed for this hack
+from pwnlib.util.packing import ops, sizes, make_multi
+import sys
+
+try:
+    from typing import Union, Optional, Literal
+
+    endianess = Union[Literal["big"]]
+
+except ImportError:
+    pass
+mod = sys.modules[__name__]
+
+
+_DEFINES = ["u8", "p8", "u32", "u16", "p32"]
+
+
+def u8(data, endian=None):
+    # type: (bytes, Optional[endianess]) -> int
+    pass
+
+
+def p8(number, endian=None):
+    # type: (int, Optional[endianess]) -> bytes
+    pass
+
+
+def u16(data, endian=None):
+    # type: (bytes, Optional[endianess]) -> int
+    pass
+
+
+def p16(number, endian=None):
+    # type: (int, Optional[endianess]) -> bytes
+    pass
+
+
+def u32(data, endian=None):
+    # type: (bytes, Optional[endianess]) -> int
+    pass
+
+
+def p32(number, endian=None):
+    # type: (int, Optional[endianess]) -> bytes
+    pass
+
+
+for op, size in iters.product(ops, sizes):
+    name, routine = make_multi(op, size)
+    if hasattr(mod, name):
+        setattr(mod, name, routine)

ios-internalblued/.gitignore

@@ -0,0 +1,2 @@
+.theos
+.DS_STORE

ios-internalblued/Makefile

@@ -0,0 +1,14 @@
+include $(THEOS)/makefiles/common.mk
+
+TOOL_NAME = internalblued
+
+internalblued_FILES = main.m ios-proxy.m
+internalblued_CFLAGS = -fobjc-arc
+
+include $(THEOS_MAKE_PATH)/tool.mk
+
+SUBPROJECTS += internalbluedprefs
+include $(THEOS_MAKE_PATH)/aggregate.mk
+
+after-internalblued-stage::
+	$(ECHO_NOTHING)$(FAKEROOT) chown root:wheel $(THEOS_STAGING_DIR)/Library/LaunchDaemons/com.ttdennis.internalblued.plist$(ECHO_END)

ios-internalblued/README.md

@@ -0,0 +1,25 @@
+# internalblued 
+This project is a proxy that redirects the *iOS* Bluetooth socket and exposes it as a
+TCP socket which can be used to send HCI commands to the Bluetooth controller of the device.
+A jailbroken device is required.
+
+A compiled version of `internalblued` can be found in [`packages/com.ttdennis.internalblued_0.0.1_iphoneos-arm.deb`](packages/com.ttdennis.internalblued_0.0.1_iphoneos-arm.deb).
+
+## Installing
+1. Transfer the `.deb` file to your iOS device
+2. Run `dpkg -i your-deb-file.deb` to install `internalblued` on your device
+
+## Running internalblued
+Once installed, `internalblued` runs as a `LaunchDaemon` and is ready to be used. By default it will listen to port 1234 (TCP) on localhost. If `usbmux` is installed, `internalblue` will be able to connect to the phone as the port is passed through `usbmuxd`.
+
+During usage with `internalblue` Bluetooth has to be disabled in the phones Settings App.
+
+In case the Bluetooth chip stops responding, Bluetooth has to be turned on and off again in the Settings App.
+
+There is a Settings App pane for `internalblued` to turn off the daemon and adapt the listening port. However, this is usually not required. As long as `internalblue` is not connected to `internalblued`'s socket, Bluetooth can be used without any restrictions.
+
+## Building internalblued
+1. Install [theos](https://github.com/theos/theos)
+2. Run `make`
+3. A `.deb` file should be in the `packages` folder now
+

ios-internalblued/internalbluedprefs/IBDRootListController.h

@@ -0,0 +1,5 @@
+#import <Preferences/PSListController.h>
+
+@interface IBDRootListController : PSListController
+
+@end

ios-internalblued/internalbluedprefs/IBDRootListController.m

@@ -0,0 +1,80 @@
+#include <xpc/xpc.h>
+
+#include "IBDRootListController.h"
+#import <Preferences/PSListController.h>
+#import <Preferences/PSViewController.h>
+#import <Preferences/PSSpecifier.h>
+#include "../xpc_protocol.h"
+
+#define PREF_FILE @"/var/mobile/Library/Preferences/com.ttdennis.internalblue-prefs.plist"
+
+@implementation IBDRootListController
+
+xpc_connection_t get_connection() {
+    xpc_connection_t connection = xpc_connection_create_mach_service(
+            "com.ttdennis.internalblued", NULL, 0);
+    // we don't expect any responses anyway
+	xpc_connection_set_event_handler(connection, ^(xpc_object_t some_object) { });
+	xpc_connection_resume(connection);
+
+    NSLog(@"connection %@", connection);
+    return connection;
+}
+
+-(bool) should_stop {
+    for (PSSpecifier *spec in [self specifiers]) {
+        if ([[spec identifier] isEqualToString:@"enabled"]) {
+            bool isEnabled = [[self readPreferenceValue:spec] boolValue];
+            NSLog(@"Toggle is: %d", isEnabled);
+            return !isEnabled;
+        }
+    }
+    return false;
+}
+
+- (void)toggle:(NSNotification *)notification {
+    // close the number keyboard
+    [self.view endEditing:YES];
+    // force write the preference file so that the daemon will pick up the correct value
+    CFPreferencesSynchronize(CFSTR("com.ttdennis.internalblue-prefs"), kCFPreferencesCurrentUser, kCFPreferencesCurrentHost);
+
+    sleep(1);
+
+    xpc_connection_t connection = get_connection();
+    xpc_object_t object = xpc_dictionary_create(NULL, NULL, 0);
+   
+    if ([self should_stop]){
+        xpc_dictionary_set_uint64(object, "message", CMD_STOP_PROXY);
+    } else {
+        xpc_dictionary_set_uint64(object, "message", CMD_START_PROXY);
+    }
+    
+    xpc_connection_send_message(connection, object);
+}
+
+void notify_ns() {
+    [[NSNotificationCenter defaultCenter] postNotificationName:@"com.ttdennis.internalblue/toggle" object:nil];
+}
+
+
+- (id) init {
+    self = [super init];
+
+    [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(toggle:) 
+                                            name:@"com.ttdennis.internalblue/toggle"
+                                            object:nil];
+    CFNotificationCenterAddObserver(CFNotificationCenterGetDarwinNotifyCenter(), (__bridge const void *)(self), (CFNotificationCallback)notify_ns, 
+            CFSTR("com.ttdennis.internalblue/toggle"), NULL, 0);
+            
+    return self;
+}
+
+- (NSArray *)specifiers {
+	if (!_specifiers) {
+		_specifiers = [self loadSpecifiersFromPlistName:@"Root" target:self];
+	}
+
+	return _specifiers;
+}
+
+@end

ios-internalblued/internalbluedprefs/Makefile

@@ -0,0 +1,15 @@
+include $(THEOS)/makefiles/common.mk
+
+BUNDLE_NAME = internalbluedprefs
+
+internalbluedprefs_FILES = IBDRootListController.m
+internalbluedprefs_INSTALL_PATH = /Library/PreferenceBundles
+internalbluedprefs_FRAMEWORKS = UIKit
+internalbluedprefs_PRIVATE_FRAMEWORKS = Preferences
+internalbluedprefs_CFLAGS = -fobjc-arc
+
+include $(THEOS_MAKE_PATH)/bundle.mk
+
+internal-stage::
+	$(ECHO_NOTHING)mkdir -p $(THEOS_STAGING_DIR)/Library/PreferenceLoader/Preferences$(ECHO_END)
+	$(ECHO_NOTHING)cp entry.plist $(THEOS_STAGING_DIR)/Library/PreferenceLoader/Preferences/internalbluedprefs.plist$(ECHO_END)

ios-internalblued/internalbluedprefs/Resources/Info.plist

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+	<key>CFBundleExecutable</key>
+	<string>internalbluedprefs</string>
+	<key>CFBundleIdentifier</key>
+	<string>com.ttdennis.internalblue-prefs</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundlePackageType</key>
+	<string>BNDL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>1.0.0</string>
+	<key>CFBundleSignature</key>
+	<string>????</string>
+	<key>CFBundleVersion</key>
+	<string>1.0</string>
+	<key>NSPrincipalClass</key>
+	<string>IBDRootListController</string>
+</dict>
+</plist>

ios-internalblued/internalbluedprefs/Resources/Root.plist

@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>items</key>
+	<array>
+		<dict>
+			<key>cell</key>
+			<string>PSGroupCell</string>
+            <key>footerText</key>
+			<string>Enable the InternalBlue proxy. For a reliable performance Bluetooth must be disabled in the settings.</string>    
+        </dict>
+		<dict>
+			<key>cell</key>
+			<string>PSSwitchCell</string>
+			<key>default</key>
+			<false/>
+			<key>defaults</key>
+			<string>com.ttdennis.internalblue-prefs</string>
+			<key>key</key>
+			<string>isEnabled</string>
+			<key>label</key>
+            <string>Enable InternalBlue Proxy</string>
+            <key>PostNotification</key>
+            <string>com.ttdennis.internalblue/toggle</string>
+            <key>id</key>
+            <string>enabled</string>
+		</dict>
+		<dict>
+			<key>cell</key>
+			<string>PSGroupCell</string>
+            <key>footerText</key>
+			<string>This sets the port the proxy is listening on. InternalBlue assumes 1234. Changing this port requires adapting InternalBlue and restarting the proxy.</string>    
+        </dict>
+        <dict>
+            <key>cell</key>
+            <string>PSEditTextCell</string>
+            <key>default</key>
+            <string>1234</string>
+            <key>defaults</key>
+            <string>com.ttdennis.internalblue-prefs</string>
+            <key>key</key>
+            <string>port</string>
+            <key>label</key>
+            <string>Proxy Port</string>
+            <key>isNumeric</key>
+            <true/>
+            <key>id</key>
+            <string>port</string>
+        </dict>
+	</array>
+	<key>title</key>
+	<string>InternalBlue Proxy Settings</string>
+</dict>
+</plist>

ios-internalblued/internalbluedprefs/entry.plist

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>entry</key>
+	<dict>
+		<key>bundle</key>
+		<string>internalbluedprefs</string>
+		<key>cell</key>
+		<string>PSLinkCell</string>
+		<key>detail</key>
+		<string>IBDRootListController</string>
+		<key>icon</key>
+		<string>icon.png</string>
+		<key>isController</key>
+		<true/>
+		<key>label</key>
+		<string>InternalBlue Proxy</string>
+	</dict>
+</dict>
+</plist>

ios-internalblued/ios-proxy.h

@@ -0,0 +1,29 @@
+//
+//  ios-proxy.h
+//  ios-proxy
+//
+//  Copyright © 2019 ttdennis. All rights reserved.
+//
+
+#ifndef ios_proxy_h
+#define ios_proxy_h
+
+#include <stdio.h>
+
+
+#define IOAOSSKYSETCHANNELSPEC 0x800C5414
+#define IOAOSSKYGETCHANNELUUID 0x40105412
+
+#define CTLIOCGINFO 0xC0644E03
+
+typedef struct ctl_info {
+    uint32_t ctl_id;
+    char ctl_name[96];
+} ctl_info_t;
+
+int connect_bt_device();
+int create_server(int port);
+int wait_for_connection(int server_fd);
+void proxy_bt_socket(int client, int bt);
+
+#endif /* ios_proxy_h */

ios-internalblued/ios-proxy.m

@@ -1,12 +1,11 @@
 //
-//  internalblue-ios-proxy.c
-//  internalblue-ios-proxy
+//  ios-proxy.m
+//  ios-proxy
 //
-//  Created by ttdennis on 03.05.19.
 //  Copyright © 2019 ttdennis. All rights reserved.
 //
 
-#include "internalblue-ios-proxy.h"
+#include "ios-proxy.h"
 
 #include <stdlib.h>
 #include <fcntl.h>
@@ -24,23 +23,6 @@
 #include <unistd.h>
 #include <termios.h>
 
-#define IOAOSSKYSETCHANNELSPEC 0x800C5414
-#define IOAOSSKYGETCHANNELUUID 0x40105412
-
-#define CTLIOCGINFO 0xC0644E03
-
-typedef struct ctl_info {
-    uint32_t ctl_id;
-    char ctl_name[96];
-} ctl_info_t;
-
-int btwake_fd, bt_fd;
-
-/*
- This code has been put together by reverse-engineering BlueTool and bluetoothd on
- iOS. Some of the things that happen here are not completely understood but the goal
- was to just get it to work.
- */
 int connect_bt_device() {
 	int socket_fd = socket(32, 1, 2);
 	int error = 0;
@@ -50,7 +32,7 @@ int connect_bt_device() {
 	struct termios term;
 	
 	if (socket_fd == 0) {
-		printf("[!] Unable to get Bluetooth socket\n");
+		NSLog(@"[!] Unable to get Bluetooth socket\n");
 		return -1;
 	}
 	
@@ -58,8 +40,8 @@ int connect_bt_device() {
     ctl_inf->ctl_id = 0;
 	strcpy(ctl_inf->ctl_name, "com.apple.uart.bluetooth");
 	if ((error = ioctl(socket_fd, CTLIOCGINFO, ctl_inf))) {
-		printf("[!] ioctl(CTLIOCGINFO) = %d - errno: %d\n", error, errno);
-		printf("[!] error: %s\n", strerror(errno));
+		NSLog(@"[!] ioctl(CTLIOCGINFO) = %d - errno: %d\n", error, errno);
+		NSLog(@"[!] error: %s\n", strerror(errno));
 		return -1;
 	}
 	
@@ -67,27 +49,27 @@ int connect_bt_device() {
 	*(int *)&sock_addr.sa_data[2] = ctl_inf->ctl_id;
 	ret = connect(socket_fd, &sock_addr, 0x20);
 	if (ret != 0) {
-		printf("[!] connect() = %d - errno: %d\n", ret, errno);
-		printf("[!] error: %s\n", strerror(errno));
+		NSLog(@"[!] connect() = %d - errno: %d\n", ret, errno);
+		NSLog(@"[!] error: %s\n", strerror(errno));
 		return -1;
 	}
 	
-	printf("[*] Connected to Bluetooth chip H4 socket\n");
+	NSLog(@"[*] Connected to Bluetooth chip H4 socket\n");
 	
 	socklen_t len = 72;
 	
 	ret = getsockopt(socket_fd, 2, TIOCGETA, &term, &len);
 	if (ret != 0) {
-		printf("[!] getsockopt(TIOCGETA) = %d - errno: %d\n", ret, errno);
-		printf("[!] error: %s\n", strerror(errno));
+		NSLog(@"[!] getsockopt(TIOCGETA) = %d - errno: %d\n", ret, errno);
+		NSLog(@"[!] error: %s\n", strerror(errno));
 		return -1;
 	}
 	
 	cfmakeraw(&term);
 	ret = cfsetspeed(&term, 3000000);
 	if (ret != 0) {
-		printf("[!] cfsetspeed() = %d - errno: %d\n", ret, errno);
-		printf("[!] error: %s\n", strerror(errno));
+		NSLog(@"[!] cfsetspeed() = %d - errno: %d\n", ret, errno);
+		NSLog(@"[!] error: %s\n", strerror(errno));
 		return -1;
 	}
 	
@@ -95,8 +77,8 @@ int connect_bt_device() {
 	term.c_cflag = 232192;
 	ret = setsockopt(socket_fd, 2, TIOCSETA, &term, 0x48);
 	if (ret != 0) {
-		printf("[!] setsockopt() = %d - errno: %d\n", ret, errno);
-		printf("[!] error: %s\n", strerror(errno));
+		NSLog(@"[!] setsockopt() = %d - errno: %d\n", ret, errno);
+		NSLog(@"[!] error: %s\n", strerror(errno));
 		return -1;
 	}
 	
@@ -114,28 +96,28 @@ int create_server(int port) {
 	
 	server_fd = socket(AF_INET, SOCK_STREAM, 0);
 	if (server_fd < 0) {
-		printf("[!] Unable to create server socket\n");
+		NSLog(@"[!] Unable to create server socket\n");
 		return -1;
 	}
 	
 	addrlen = sizeof(server);
 	memset(&server, '\0', addrlen);
 	server.sin_family = AF_INET;
-	server.sin_addr.s_addr = INADDR_ANY;
+	server.sin_addr.s_addr = inet_addr("127.0.0.1");
 	server.sin_port = htons(port);
 	
 	setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &on, 4);
 	if (bind(server_fd, (struct sockaddr *)&server, sizeof(server)) < 0) {
-		printf("[!] Error binding socket\n");
+		NSLog(@"[!] Error binding socket\n");
 		return -1;
 	}
 	
 	if (listen(server_fd, 5) < 0) {
-		printf("[!] Failed listening on port %d,  Error: %s\n", port, strerror(errno));
+		NSLog(@"[!] Failed listening on port %d,  Error: %s\n", port, strerror(errno));
 		return -1;
 	}
 	
-	printf("[*] Listening on port %d\n", port);
+	NSLog(@"[*] Listening on port %d\n", port);
 	
 	return server_fd;
 }
@@ -149,7 +131,7 @@ int wait_for_connection(int server_fd) {
 	client_fd = accept(server_fd, (struct sockaddr *)&client, (socklen_t *)&len);
 	
 	if (client_fd < 0) {
-		printf("[!] Accepting connection failed\n");
+		NSLog(@"[!] Accepting connection failed\n");
 		return -1;
 	}
 	
@@ -184,7 +166,7 @@ void proxy_bt_socket(int client, int bt) {
                     write(bt, client_buf, n);
                 } else {
                     close(client);
-                    printf("[!] Client read failed\n");
+                    NSLog(@"[!] Client read failed\n");
                     return;
                 }
 			}
@@ -195,12 +177,12 @@ void proxy_bt_socket(int client, int bt) {
                     write(client, bt_buf, n);
                 } else {
                     close(client);
-                    printf("[!] H4 socket read failed\n");
+                    NSLog(@"[!] H4 socket read failed\n");
                     return;
                 }
 			}
 		} else if (x < 0 && errno != EINTR){
-			printf("[!] Select failed with %s\n", strerror(errno));
+			NSLog(@"[!] Select failed with %s\n", strerror(errno));
 			close(client);
 			return;
 		}
@@ -208,54 +190,4 @@ void proxy_bt_socket(int client, int bt) {
 	}
 }
 
-void __exit(int sig) {
-	close(bt_fd);
-	close(btwake_fd);
-	exit(0);
-}
 
-int main(int argc, char **argv) {
-	int server_fd, client_fd;
-	int port;
-	
-	if (argc != 2) {
-		printf("Usage: %s <port_number>\n", argv[0]);
-		return 1;
-	}
-	
-	port = atoi(argv[1]);
-	
-    while (1) {
-        // wake BT device
-        btwake_fd = open("/dev/btwake", 0);
-        
-        bt_fd = connect_bt_device();
-        if (bt_fd < 0) {
-            printf("[!] Error connecting to bluetooth device\n");
-            return -1;
-        }
-        
-        server_fd = create_server(port);
-        if (server_fd < 0) {
-            printf("[!] Unable to create proxy server\n");
-            return -1;
-        }
-        printf("[*] Created proxy server\n");
-        
-        signal(SIGINT, __exit);
-	
-		printf("[*] Waiting for remote connection\n");
-		client_fd = wait_for_connection(server_fd);
-		if (client_fd < 0)
-			printf("[!] Unable to connect remote device to proxy\n");
-		
-        // currently only one connection is supported
-		proxy_bt_socket(client_fd, bt_fd);
-		close(client_fd);
-        close(server_fd);
-        close(bt_fd);
-        close(btwake_fd);
-	}
-	
-	return 0;
-}

ios-internalblued/layout/DEBIAN/control

@@ -0,0 +1,9 @@
+Package: com.ttdennis.internalblued
+Name: internalblued
+Depends:
+Version: 0.0.1
+Architecture: iphoneos-arm
+Description: InternalBlue iOS Proxy Daemon
+Maintainer: Dennis Heinze
+Author: Dennis Heinze
+Section: System

ios-internalblued/layout/DEBIAN/postinst

@@ -0,0 +1,2 @@
+#!/bin/sh
+launchctl load /Library/LaunchDaemons/com.ttdennis.internalblued.plist

ios-internalblued/layout/DEBIAN/preinst

@@ -0,0 +1,2 @@
+#!/bin/sh
+launchctl unload /Library/LaunchDaemons/com.ttdennis.internalblued.plist 2>&1 > /dev/null

ios-internalblued/layout/DEBIAN/prerm

@@ -0,0 +1,2 @@
+#!/bin/sh
+launchctl unload /Library/LaunchDaemons/com.ttdennis.internalblued.plist

ios-internalblued/layout/Library/LaunchDaemons/com.ttdennis.internalblued.plist

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.ttdennis.internalblued</string>
+    <key>MachServices</key>
+    <dict>
+        <key>com.ttdennis.internalblued</key>
+        <true/>
+    </dict>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/usr/bin/internalblued</string>
+    </array>
+    <key>UserName</key>
+    <string>mobile</string>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+</dict>
+</plist>

ios-internalblued/main.m

@@ -0,0 +1,179 @@
+#include <xpc/xpc.h>
+#include <pthread.h>
+#include <spawn.h>
+
+#include "ios-proxy.h"
+#include "xpc_protocol.h"
+
+#define PREF_FILE @"/var/mobile/Library/Preferences/com.ttdennis.internalblue-prefs.plist"
+
+int manual_port = -1;
+bool proxy_is_running = false;
+pthread_t proxy_thread;
+
+int get_proxy_port() {
+    int port = 0;
+    if (manual_port != -1) {
+        return manual_port;
+    }
+    
+    NSMutableDictionary *prefs = [[NSMutableDictionary alloc] initWithContentsOfFile: PREF_FILE];
+    if (prefs) {
+        port = [[prefs objectForKey:@"port"] intValue];
+    } else {
+        NSLog(@"Preference file not found, chosing standard port 1234");
+    }
+
+    if (port == 0)
+        port = 1234;
+
+    return port;
+}
+
+bool proxy_pref_on() {
+    bool res = true;
+    NSMutableDictionary *prefs = [[NSMutableDictionary alloc] initWithContentsOfFile: PREF_FILE];
+    if (prefs) {
+        id obj = [prefs objectForKey:@"isEnabled"];
+        // no object exists, this means the user never toggled the switch
+        // which means the server is on (because it is by default), and we
+        // should stop -> return true
+        if (!obj) {
+            return true;
+        }
+        res = [obj boolValue];
+    } else {
+        NSLog(@"Preference file not found, chosing standard value true");
+    }
+
+    return res;
+}
+
+void *proxy_fn() {
+    int port = get_proxy_port();
+    int server_fd, client_fd, btwake_fd, bt_fd;
+
+    while (proxy_is_running) {
+        server_fd = create_server(port);
+        if (server_fd < 0) {
+            NSLog(@"Unable to create proxy server: %s", strerror(errno));
+            break;
+        }
+        NSLog(@"Created proxy server, waiting for connection");
+
+        client_fd = wait_for_connection(server_fd);
+        if (client_fd < 0) {
+            NSLog(@"Unable to establish connection: %s", strerror(errno));
+            close(server_fd);
+        }
+
+        // now that a client connection from internalblue is established
+        // we can claim the BT device
+        btwake_fd = open("/dev/btwake", O_RDONLY);
+        bt_fd = connect_bt_device();
+        if (bt_fd < 0) {
+            NSLog(@"Unable to connect to Bluetooth device: %s", strerror(errno));
+            close(server_fd);
+            close(client_fd);
+            close(btwake_fd);
+        }
+
+        // currently only one connection is supported
+        proxy_bt_socket(client_fd, bt_fd);
+
+        close(client_fd);
+        close(server_fd);
+        close(bt_fd);
+        close(btwake_fd);
+    }
+
+    return NULL;
+}
+
+void start_proxy() {
+    if (proxy_is_running) {
+        NSLog(@"Cannot start proxy, it is already running");
+    } else {
+        pthread_create(&proxy_thread, NULL, &proxy_fn, NULL);
+        proxy_is_running = true;
+    }
+}
+
+void stop_proxy() {
+    if (proxy_is_running) {
+        pthread_kill(proxy_thread, SIGKILL);
+        proxy_is_running = false;
+    } else {
+        NSLog(@"Cannot stop proxy, it is not running");
+    }
+}
+
+void _ib_xpc_recv_handler(xpc_object_t object) {
+    uint64_t opcode = xpc_dictionary_get_uint64(object, "message");
+    if ((void*)opcode == NULL) {
+        NSLog(@"Received invalid message.");
+        return;
+    }
+    NSLog(@"Got message with opcode %llu", opcode);
+
+    switch(opcode) {
+        case CMD_START_PROXY:
+            start_proxy();
+            break;
+        case CMD_STOP_PROXY:
+            stop_proxy();
+            break;
+    }
+}
+
+int main(int argc, char *argv[], char *envp[]) {
+	@autoreleasepool {
+        if (argc > 1) {
+            int port = atoi(argv[1]);
+            NSLog(@"Hi, looks like you manually started internalblued on port %d", port);
+            if (proxy_pref_on()) {
+                int _configured_port = get_proxy_port();
+                NSLog(@"internalblued is already running on port %d. Please turn it off in the iPhone's preferences first, before launching it manually.", _configured_port);
+                exit(-1);
+            }
+            manual_port = port;
+            start_proxy();
+            [[NSRunLoop currentRunLoop] run];
+        } else {
+            // Start the proxy if pref allows us to
+            if (proxy_pref_on()) {
+                NSLog(@"Starting proxy because it is enabled.");
+                start_proxy();
+            }
+
+            // Attempt to create the server, exit if this fails
+            xpc_connection_t connection = xpc_connection_create_mach_service("com.ttdennis.internalblued", NULL, XPC_CONNECTION_MACH_SERVICE_LISTENER);
+            if (!connection) {
+                NSLog(@"Failed to create XPC server. Exiting.");
+                return 0;
+            }
+
+            // Configure event handler
+            xpc_connection_set_event_handler(connection, ^(xpc_object_t object) {
+                xpc_type_t type = xpc_get_type(object);
+                if (type == XPC_TYPE_CONNECTION) {
+                    NSLog(@"XPC server received incoming connection: %s", xpc_copy_description(object));
+
+                    xpc_connection_set_event_handler(object, ^(xpc_object_t some_object) {
+                        NSLog(@"XPC connection received object: %s", xpc_copy_description(some_object));
+                        _ib_xpc_recv_handler(some_object);
+                    });
+                    xpc_connection_resume(object);
+                } else if (type == XPC_TYPE_ERROR) {
+                    NSLog(@"XPC server error: %s", xpc_dictionary_get_string(object, XPC_ERROR_KEY_DESCRIPTION));
+                } else {
+                    NSLog(@"XPC server received unknown object: %s", xpc_copy_description(object));
+                }
+            });
+
+            xpc_connection_resume(connection);
+            [[NSRunLoop currentRunLoop] run];
+        }
+		return 0;
+	}
+}

ios-internalblued/xpc_protocol.h

@@ -0,0 +1,4 @@
+#define CMD_RESTART_BLUETOOTHD 0
+#define CMD_START_PROXY 1
+#define CMD_STOP_PROXY 2
+#define CMD_RESTART_PROXY 3

ios-proxy/README.md

@@ -1,38 +0,0 @@
-# internalblue-ios-proxy
-This project is a proxy that redirects the *iOS* Bluetooth socket and exposes it as a
-TCP socket which can be used to send HCI commands to the Bluetooth controller of the device.
-A jailbroken device is required. To compile the project, a Mac with xcode is required.
-The precompiled `ios-proxy` binary was tested on the iPhone 6 (12.1.2, 12.4), iPhone SE (12.4),
-iPhone 7 (12.1.2, 12.4), and iPhone X (12.4).
-
-## Building internalblue-ios-proxy
-Open the project with xcode and compile it. Xcode will create a single binary that can then be transferred onto the device.
-
-## Installing internalblue-ios-proxy
-1. Right-click the `internalblue-ios-proxy` binary and click "Show in Finder". This will open the location the compiled binary resides in.
-2. Move the binary onto the device (e.g. with scp) at a location where applications are allowed to be executed (e.g. `/bin` or `/sbin`).
-3. The binary needs the `platform-application` entitlement. This is achieved by signing the binary with the included `entitlements.xml` file. 
-Sign it using `ldid -Sentitlements.xml internalblue-ios-proxy`. `ldid` should be on a jailbroken device with Cydia by default.
-
-If `ldid` was not installed with your jailbreak, try opening [sileo://package/ldid](sileo://package/ldid).
-
-## Running internalblue-ios-proxy
-Run the proxy by executing `internalblue-ios-proxy <port-number>`.
-The phone will then listen on this port and can be accessed either when on the same Wi-Fi or
-by proxying the port through USB (using [usbmuxd](https://iphonedevwiki.net/index.php/SSH_Over_USB)).
-When enabling a personal hotspot, you can also run `dhclient` on *Linux* on the new local ethernet interface.
-
-A few things to note:
-- To increase reliability of the proxy, *Bluetooth should be disabled*
-  (either by manually stopping the Bluetooth daemon or by shutting of Bluetooth in the
-  settings on the phone). Despite shutting down Bluetooth, the RAM will still have the same contents
-  as during previous usage, and you can analyze it.
-- The current implementation sometimes returns wrong results, thus we double-check results of 
-  commands that read ROM/RAM. We show warnings, but firmware dumps should complete nonetheless.
-- To get sufficient performance, access the `ios-proxy` over USB and not using Wi-Fi.
-- In case the Bluetooth chip crashes or does not respond anymore over the proxy,
-  the proxy should be stopped and Bluetooth should be turned off and on again in the UI.
-- Sometimes the Bluetooth socket will not respond anymore after establishing a second connection,
-  just restart the proxy then.
-
-This project is based on Brandon Azad's [iOS command line tool](https://github.com/bazad/ios-command-line-tool) template.

ios-proxy/entitlements.xml

@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>platform-application</key>
-    <true/>
-</dict>
-</plist>

ios-proxy/internalblue-ios-proxy.xcodeproj/project.pbxproj

@@ -1,285 +0,0 @@
-// !$*UTF8*$!
-{
-	archiveVersion = 1;
-	classes = {
-	};
-	objectVersion = 50;
-	objects = {
-
-/* Begin PBXBuildFile section */
-		BB958F25227BA4580029C2D6 /* internalblue-ios-proxy.c in Sources */ = {isa = PBXBuildFile; fileRef = BB958F24227BA4580029C2D6 /* internalblue-ios-proxy.c */; };
-/* End PBXBuildFile section */
-
-/* Begin PBXFileReference section */
-		551A88C4208E671F0048DFA0 /* internalblue-ios-proxy */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.dylib"; includeInIndex = 0; path = "internalblue-ios-proxy"; sourceTree = BUILT_PRODUCTS_DIR; };
-		BB958F23227BA4580029C2D6 /* internalblue-ios-proxy.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = "internalblue-ios-proxy.h"; sourceTree = "<group>"; };
-		BB958F24227BA4580029C2D6 /* internalblue-ios-proxy.c */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.c; path = "internalblue-ios-proxy.c"; sourceTree = "<group>"; };
-/* End PBXFileReference section */
-
-/* Begin PBXFrameworksBuildPhase section */
-		551A88C1208E671F0048DFA0 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXFrameworksBuildPhase section */
-
-/* Begin PBXGroup section */
-		551A88BB208E671F0048DFA0 = {
-			isa = PBXGroup;
-			children = (
-				551A88C6208E671F0048DFA0 /* internalblue-ios-proxy */,
-				551A88C5208E671F0048DFA0 /* Products */,
-			);
-			sourceTree = "<group>";
-		};
-		551A88C5208E671F0048DFA0 /* Products */ = {
-			isa = PBXGroup;
-			children = (
-				551A88C4208E671F0048DFA0 /* internalblue-ios-proxy */,
-			);
-			name = Products;
-			sourceTree = "<group>";
-		};
-		551A88C6208E671F0048DFA0 /* internalblue-ios-proxy */ = {
-			isa = PBXGroup;
-			children = (
-				BB958F23227BA4580029C2D6 /* internalblue-ios-proxy.h */,
-				BB958F24227BA4580029C2D6 /* internalblue-ios-proxy.c */,
-			);
-			path = "internalblue-ios-proxy";
-			sourceTree = "<group>";
-		};
-/* End PBXGroup section */
-
-/* Begin PBXNativeTarget section */
-		551A88C3208E671F0048DFA0 /* internalblue-ios-proxy */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 551A88CD208E671F0048DFA0 /* Build configuration list for PBXNativeTarget "internalblue-ios-proxy" */;
-			buildPhases = (
-				551A88C0208E671F0048DFA0 /* Sources */,
-				551A88C1208E671F0048DFA0 /* Frameworks */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			name = "internalblue-ios-proxy";
-			productName = "ios-command-line-tool";
-			productReference = 551A88C4208E671F0048DFA0 /* internalblue-ios-proxy */;
-			productType = "com.apple.product-type.library.dynamic";
-		};
-/* End PBXNativeTarget section */
-
-/* Begin PBXProject section */
-		551A88BC208E671F0048DFA0 /* Project object */ = {
-			isa = PBXProject;
-			attributes = {
-				LastUpgradeCheck = 0930;
-				ORGANIZATIONNAME = ttdennis;
-				TargetAttributes = {
-					551A88C3208E671F0048DFA0 = {
-						CreatedOnToolsVersion = 9.3;
-					};
-				};
-			};
-			buildConfigurationList = 551A88BF208E671F0048DFA0 /* Build configuration list for PBXProject "internalblue-ios-proxy" */;
-			compatibilityVersion = "Xcode 9.3";
-			developmentRegion = en;
-			hasScannedForEncodings = 0;
-			knownRegions = (
-				en,
-			);
-			mainGroup = 551A88BB208E671F0048DFA0;
-			productRefGroup = 551A88C5208E671F0048DFA0 /* Products */;
-			projectDirPath = "";
-			projectRoot = "";
-			targets = (
-				551A88C3208E671F0048DFA0 /* internalblue-ios-proxy */,
-			);
-		};
-/* End PBXProject section */
-
-/* Begin PBXSourcesBuildPhase section */
-		551A88C0208E671F0048DFA0 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				BB958F25227BA4580029C2D6 /* internalblue-ios-proxy.c in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXSourcesBuildPhase section */
-
-/* Begin XCBuildConfiguration section */
-		551A88CB208E671F0048DFA0 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				CODE_SIGN_IDENTITY = "iPhone Developer";
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_TESTABILITY = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				GCC_DYNAMIC_NO_PIC = NO;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_OPTIMIZATION_LEVEL = 0;
-				GCC_PREPROCESSOR_DEFINITIONS = (
-					"DEBUG=1",
-					"$(inherited)",
-				);
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 11.0;
-				MTL_ENABLE_DEBUG_INFO = YES;
-				ONLY_ACTIVE_ARCH = YES;
-				SDKROOT = iphoneos;
-			};
-			name = Debug;
-		};
-		551A88CC208E671F0048DFA0 /* Release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				CODE_SIGN_IDENTITY = "iPhone Developer";
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
-				ENABLE_NS_ASSERTIONS = NO;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 11.0;
-				MTL_ENABLE_DEBUG_INFO = NO;
-				SDKROOT = iphoneos;
-				VALIDATE_PRODUCT = YES;
-			};
-			name = Release;
-		};
-		551A88CE208E671F0048DFA0 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				CODE_SIGN_STYLE = Automatic;
-				DEVELOPMENT_TEAM = RSU3RMH9UZ;
-				DYLIB_COMPATIBILITY_VERSION = "";
-				DYLIB_CURRENT_VERSION = "";
-				EXECUTABLE_PREFIX = "";
-				EXECUTABLE_SUFFIX = "";
-				MACH_O_TYPE = mh_execute;
-				OTHER_LDFLAGS = "-ObjC";
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SKIP_INSTALL = YES;
-				TARGETED_DEVICE_FAMILY = "1,2";
-			};
-			name = Debug;
-		};
-		551A88CF208E671F0048DFA0 /* Release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				CODE_SIGN_STYLE = Automatic;
-				DEVELOPMENT_TEAM = RSU3RMH9UZ;
-				DYLIB_COMPATIBILITY_VERSION = "";
-				DYLIB_CURRENT_VERSION = "";
-				EXECUTABLE_PREFIX = "";
-				EXECUTABLE_SUFFIX = "";
-				MACH_O_TYPE = mh_execute;
-				OTHER_LDFLAGS = "-ObjC";
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SKIP_INSTALL = YES;
-				TARGETED_DEVICE_FAMILY = "1,2";
-			};
-			name = Release;
-		};
-/* End XCBuildConfiguration section */
-
-/* Begin XCConfigurationList section */
-		551A88BF208E671F0048DFA0 /* Build configuration list for PBXProject "internalblue-ios-proxy" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				551A88CB208E671F0048DFA0 /* Debug */,
-				551A88CC208E671F0048DFA0 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		551A88CD208E671F0048DFA0 /* Build configuration list for PBXNativeTarget "internalblue-ios-proxy" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				551A88CE208E671F0048DFA0 /* Debug */,
-				551A88CF208E671F0048DFA0 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-/* End XCConfigurationList section */
-	};
-	rootObject = 551A88BC208E671F0048DFA0 /* Project object */;
-}

ios-proxy/internalblue-ios-proxy.xcodeproj/xcshareddata/xcschemes/internalblue-ios-proxy.xcscheme

@@ -1,80 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Scheme
-   LastUpgradeVersion = "1020"
-   version = "1.3">
-   <BuildAction
-      parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES">
-      <BuildActionEntries>
-         <BuildActionEntry
-            buildForTesting = "YES"
-            buildForRunning = "YES"
-            buildForProfiling = "YES"
-            buildForArchiving = "YES"
-            buildForAnalyzing = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "551A88C3208E671F0048DFA0"
-               BuildableName = "internalblue-ios-proxy"
-               BlueprintName = "internalblue-ios-proxy"
-               ReferencedContainer = "container:internalblue-ios-proxy.xcodeproj">
-            </BuildableReference>
-         </BuildActionEntry>
-      </BuildActionEntries>
-   </BuildAction>
-   <TestAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES">
-      <Testables>
-      </Testables>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </TestAction>
-   <LaunchAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      launchStyle = "0"
-      useCustomWorkingDirectory = "NO"
-      ignoresPersistentStateOnLaunch = "NO"
-      debugDocumentVersioning = "YES"
-      debugServiceExtension = "internal"
-      allowLocationSimulation = "YES">
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "551A88C3208E671F0048DFA0"
-            BuildableName = "internalblue-ios-proxy"
-            BlueprintName = "internalblue-ios-proxy"
-            ReferencedContainer = "container:internalblue-ios-proxy.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </LaunchAction>
-   <ProfileAction
-      buildConfiguration = "Release"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      savedToolIdentifier = ""
-      useCustomWorkingDirectory = "NO"
-      debugDocumentVersioning = "YES">
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "551A88C3208E671F0048DFA0"
-            BuildableName = "internalblue-ios-proxy"
-            BlueprintName = "internalblue-ios-proxy"
-            ReferencedContainer = "container:internalblue-ios-proxy.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-   </ProfileAction>
-   <AnalyzeAction
-      buildConfiguration = "Debug">
-   </AnalyzeAction>
-   <ArchiveAction
-      buildConfiguration = "Release"
-      revealArchiveInOrganizer = "YES">
-   </ArchiveAction>
-</Scheme>

ios-proxy/internalblue-ios-proxy/internalblue-ios-proxy.h

@@ -1,14 +0,0 @@
-//
-//  internalblue-ios-proxy.h
-//  internalblue-ios-proxy
-//
-//  Created by ttdennis on 03.05.19.
-//  Copyright © 2019 ttdennis. All rights reserved.
-//
-
-#ifndef internalblue_ios_proxy_h
-#define internalblue_ios_proxy_h
-
-#include <stdio.h>
-
-#endif /* internalblue_ios_proxy_h */

macos-framework/IOBluetoothExtended/IOBluetoothExtended/HCICommunicator.h

@@ -13,7 +13,8 @@
 
 @interface HCICommunicator: NSObject
 
-+ (NSArray *) sendArbitraryCommand4:(uint8_t [])arg1 len:(uint8_t)arg2;
++ (void) sendHCICommand:(uint8_t [])arg1 len:(uint8_t)arg2;
++ (void) sendACLCommand:(uint8_t [])arg1 len:(uint8_t)arg2;
 
 @end
 

macos-framework/IOBluetoothExtended/IOBluetoothExtended/HCICommunicator.m

@@ -12,14 +12,12 @@
 
 @implementation HCICommunicator
 
-+ (NSArray *)sendArbitraryCommand4:(uint8_t [])arg1 len:(uint8_t)arg2 {
++ (void) sendHCICommand:(uint8_t [])arg1 len:(uint8_t)arg2 {
     NSData *data = [NSData dataWithBytes:arg1 length:arg2];
     uint8_t *command = calloc(arg2, sizeof(uint8_t));
     memcpy(command, [data bytes], arg2);
     
     BluetoothHCIRequestID request = 0;
-    static uint8_t* output[255];
-    size_t outputSize = sizeof(output);
     
     int error = BluetoothHCIRequestCreate(&request, 1000, nil, 0);
     if (error) {
@@ -41,16 +39,32 @@
     
     sleep(0x1);
     BluetoothHCIRequestDelete(request);
-    
-    uint8_t *result = calloc(255, sizeof(uint8_t));
-    memcpy(result, output, 255);
-    
-    NSMutableArray *nsarr = [[NSMutableArray alloc] init];
-    for (int i = 0; i < 255; i++) {
-        [nsarr addObject:[NSNumber numberWithUnsignedChar:result[i]]];
+}
+
++ (void) sendACLCommand:(uint8_t [])arg1 len:(uint8_t)arg2 {
+    NSData *data = [NSData dataWithBytes:arg1 length:arg2];
+    uint8_t *commandData = calloc(arg2, sizeof(uint8_t));
+    memcpy(commandData, [data bytes], arg2);
+
+    BluetoothHCIRequestID request = 0;
+
+    int error = BluetoothHCIRequestCreate(&request, 1000, nil, 0);
+    if (error) {
+        BluetoothHCIRequestDelete(request);
+        printf("Couldn't create error: %08x\n", error);
     }
-    
-    return nsarr;
+
+    // Read device handle from data
+    uint16_t handle = commandData[0];
+    error = BluetoothHCISendRawACLData(commandData, arg2, handle, request);
+
+    if (error) {
+        BluetoothHCIRequestDelete(request);
+        printf("Send HCI command Error: %08x\n", error);
+    }
+
+    sleep(0x1);
+    BluetoothHCIRequestDelete(request);
 }
 
 @end

macos-framework/IOBluetoothExtended/IOBluetoothExtended/HCIDelegate.swift

@@ -92,7 +92,13 @@ extension HCIDelegate: IOBluetoothHostControllerDelegate {
                     let length: UInt8 = receiveBuffer[1]
 
                     // Send command to Bluetooth HCI Controller
-                    HCICommunicator.sendArbitraryCommand4(&command, len: length)
+                    let hci_type = [UInt8](receiveBuffer)[0]
+                    if hci_type == 0x01 {
+                        HCICommunicator.sendHCICommand(&command, len: length)
+                    }
+                    else {
+                        HCICommunicator.sendACLCommand(&command, len: length)
+                    }
                 }
             }
             print("Exiting...")

macos-framework/IOBluetoothExtended/IOBluetoothExtended/IOBluetoothHostController.h

@@ -324,6 +324,11 @@ int BluetoothHCISendRawCommand(uint32_t request,
                                void *commandData,
                                size_t commmandSize);
 
+int BluetoothHCISendRawACLData(void *commandData,
+                               size_t commandSize,
+                               uint32_t handle,
+                               uint32_t request);
+
 int BluetoothHCIDispatchUserClientRoutine(struct IOBluetoothHCIDispatchParams *arguments,
                                           unsigned char *returnValue,
                                           size_t *returnValueSize);

mypy.ini

@@ -0,0 +1,25 @@
+
+[mypy-internalblue]
+
+python_version = 3.8
+warn_return_any = True
+
+
+[mypy-internalblue.fw.*]
+
+ignore_errors = True
+
+[mypy-internalblue.socket_hooks]
+ignore_errors = True
+
+[mypy-pwnlib.*]
+ignore_missing_imports = True
+
+[mypy-future.*]
+ignore_missing_imports = True
+
+[mypy-past.*]
+ignore_missing_imports = True
+
+[mypy-IPython]
+ignore_missing_imports = True

requirements.txt

@@ -1,2 +0,0 @@
-pwntools==3.12.2
-pyelftools==0.24

setup.py

@@ -2,18 +2,25 @@
 
 from setuptools import setup
 
-setup(name='internalblue',
-      version='0.3',
-      description='A Bluetooth Experimentation Framework based on the Broadcom Bluetooth Controller Family.',
-      url='http://github.com/seemoo-lab/internalblue',
-      author='Dennis Mantz',
-      author_email='dennis.mantz@googlemail.com',
-      license='MIT',
-      packages=['internalblue', 'internalblue/fw'],
-      install_requires=[
-          'pwntools',
-      ],
-      entry_points = {
-        'console_scripts': ['internalblue=internalblue.cli:internalblue_cli']
-      },
-      zip_safe=False)
+setup(
+    name="internalblue",
+    version="0.4",
+    description="A Bluetooth Experimentation Framework based on the Broadcom Bluetooth Controller Family.",
+    url="http://github.com/seemoo-lab/internalblue",
+    author="The InternalBlue Team",
+    author_email="jiska@bluetooth.lol",
+    license="MIT",
+    packages=[
+        "internalblue",
+        "internalblue/fw",
+        "internalblue/objects",
+        "internalblue/utils",
+    ],
+    install_requires=["pwntools>=4.0.1", "pyelftools", "future"],
+    extras_require={"macoscore": ["pyobjc"], "ipython": ["IPython"]},
+    tests_require=["nose", "pytest", "pwntools>=4.2.0.dev0"],
+    entry_points={
+        "console_scripts": ["internalblue=internalblue.cli:internalblue_entry_point"]
+    },
+    zip_safe=False,
+)

tests/generic_test.sh

@@ -0,0 +1,12 @@
+#!/bin/env sh
+line=$(head -n 1 "$1")
+
+if [[ $line == \#* ]] ;
+then
+
+	python -m internalblue.cli --device hci0 --replay "$1" --commands "$(echo $line | tr -d "#"); quit" 2>&1 | grep AssertionError || exit 0 && exit 1
+else
+	echo "Trace $1 has no command specified"
+fi
+
+

tests/test_heap_new.py

@@ -0,0 +1,282 @@
+from __future__ import print_function
+from internalblue.cli import _parse_argv
+from internalblue.hcicore import HCICore
+
+import os
+import nose
+
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple
+except ImportError:
+    pass
+
+
+def test_info_heap_new():
+    dummy = [
+        {
+            "index": 0,
+            "capacity": 32,
+            "address": 2100380,
+            "next": 2100412,
+            "memory_size": 1152,
+            "buffer_list": 2190960,
+            "memory": 2190864,
+            "buffer_size": 32,
+            "buffer_headers": {
+                2191872: 2134443254,
+                2191620: 2037880954,
+                2191368: 375085499,
+                2191116: 3147300663,
+                2190864: 0,
+                2191764: 264196083,
+                2191512: 2509895076,
+                2191260: 2520551584,
+                2191008: 0,
+                2191908: 1846542368,
+                2191656: 1757769142,
+                2191404: 3932721686,
+                2191152: 2191184,
+                2190900: 28735,
+                2191800: 2840650003,
+                2191548: 1443923039,
+                2191296: 1489683938,
+                2191044: 4066066958,
+                2191944: 1913651233,
+                2191692: 152195353,
+                2191440: 2191472,
+                2191188: 1557416373,
+                2190936: 302056974,
+                2191836: 649087106,
+                2191584: 3228135896,
+                2191332: 3061215438,
+                2191080: 720823376,
+                2191980: 2196903397,
+                2191728: 2191760,
+                2191476: 2016717863,
+                2191224: 733933656,
+                2190972: 101581052
+            },
+            "list_length": 28
+        },
+        {
+            "index": 1,
+            "capacity": 50,
+            "address": 2100412,
+            "next": 2100444,
+            "memory_size": 5000,
+            "buffer_list": 2191888,
+            "memory": 2191888,
+            "buffer_size": 96,
+            "buffer_headers": {
+                2194688: 2418054699,
+                2196288: 1950181917,
+                2192388: 998902997,
+                2193288: 1237870693,
+                2196588: 3682344019,
+                2194188: 3476501705,
+                2191888: 2191984,
+                2195288: 1169168150,
+                2192788: 733035576,
+                2193688: 212170382,
+                2195588: 4256985711,
+                2194588: 2553343043,
+                2196688: 2197224,
+                2192288: 1364917638,
+                2195888: 19938058,
+                2193188: 1183181508,
+                2194088: 2389621397,
+                2196188: 1101316817,
+                2194988: 4119138959,
+                2192688: 3404258821,
+                2196488: 2957618219,
+                2193588: 1015303433,
+                2194488: 1542989588,
+                2195188: 334177442,
+                2192188: 3048389179,
+                2193088: 4249806944,
+                2195488: 1476670297,
+                2193988: 4205996809,
+                2196788: 0,
+                2194888: 1063521161,
+                2195788: 1587397832,
+                2192588: 3951930416,
+                2193488: 3182543110,
+                2196088: 1404536822,
+                2194388: 3962928810,
+                2192088: 1508747568,
+                2196388: 2481150443,
+                2192988: 3794218756,
+                2193888: 2230011074,
+                2195088: 2388733849,
+                2194788: 319481313,
+                2192488: 1066099460,
+                2195388: 2397324227,
+                2193388: 3268540448,
+                2194288: 2194384,
+                2195688: 443293108,
+                2191988: 3365837461,
+                2192888: 2725717105,
+                2195988: 954670552,
+                2193788: 2274473962
+            },
+            "list_length": 50
+        },
+        {
+            "index": 2,
+            "capacity": 12,
+            "address": 2100444,
+            "next": 2169260,
+            "memory_size": 3264,
+            "buffer_list": 2196688,
+            "memory": 2196688,
+            "buffer_size": 268,
+            "buffer_headers": {
+                2196960: 1868719728,
+                2198048: 2301952667,
+                2197504: 2764580300,
+                2198592: 4031749240,
+                2199408: 3141828370,
+                2199680: 2673196138,
+                2197776: 655413012,
+                2196688: 2197224,
+                2198864: 483218198,
+                2199136: 2070409995,
+                2197232: 4269595008,
+                2198320: 2960663615
+            },
+            "list_length": 11
+        },
+        {
+            "index": 3,
+            "capacity": 4,
+            "address": 2169260,
+            "next": 2169292,
+            "memory_size": 4288,
+            "buffer_list": 2199904,
+            "memory": 2199904,
+            "buffer_size": 1068,
+            "buffer_headers": {
+                2199904: 2200972,
+                2200976: 3538041113,
+                2202048: 1981831315,
+                2203120: 2664647264
+            },
+            "list_length": 4
+        },
+        {
+            "index": 4,
+            "capacity": 16,
+            "address": 2169292,
+            "next": 2169324,
+            "memory_size": 17536,
+            "buffer_list": 2204176,
+            "memory": 2204176,
+            "buffer_size": 1092,
+            "buffer_headers": {
+                2206368: 3081486871,
+                2208560: 2201211482,
+                2218424: 1142812043,
+                2210752: 1735894938,
+                2219520: 1997110991,
+                2207464: 3467810309,
+                2220616: 3465059190,
+                2217328: 3406578824,
+                2215136: 2543784863,
+                2204176: 2205268,
+                2209656: 3726451979,
+                2214040: 3051833507,
+                2211848: 3382482014,
+                2205272: 2465189202,
+                2212944: 2900433384,
+                2216232: 619500542
+            },
+            "list_length": 16
+        },
+        {
+            "index": 5,
+            "capacity": 15,
+            "address": 2169324,
+            "next": 2169356,
+            "memory_size": 4020,
+            "buffer_list": 2221648,
+            "memory": 2221648,
+            "buffer_size": 264,
+            "buffer_headers": {
+                2222720: 4187811300,
+                2223792: 71320053,
+                2223524: 2131726092,
+                2222184: 983003111,
+                2224060: 1514897371,
+                2222988: 2920869383,
+                2225132: 670722248,
+                2225400: 4011899155,
+                2221648: 2221912,
+                2224328: 1327684221,
+                2222452: 1691084254,
+                2223256: 2278527172,
+                2224596: 3213868993,
+                2221916: 2666878639,
+                2224864: 4293236507
+            },
+            "list_length": 15
+        },
+        {
+            "index": 6,
+            "capacity": 15,
+            "address": 2169356,
+            "next": 0,
+            "memory_size": 4020,
+            "buffer_list": 2225608,
+            "memory": 2225608,
+            "buffer_size": 264,
+            "buffer_headers": {
+                2226144: 2468503925,
+                2228288: 3769100033,
+                2226948: 3003019165,
+                2225608: 2225872,
+                2228556: 1848533574,
+                2226412: 19831529,
+                2229360: 3069868169,
+                2227216: 2022414238,
+                2227752: 2727841579,
+                2228824: 1909490602,
+                2225876: 2300688060,
+                2226680: 210906155,
+                2228020: 3166977216,
+                2227484: 2262736138,
+                2229092: 1991768492
+            },
+            "list_length": 15
+        }
+    ]
+
+    trace = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                         'traces/hcicore/dictionary_tests/info_heap_new.trace')
+    args = _parse_argv('')
+    args.device = 'adb_replay'
+    args.replay = trace
+
+    data_directory = os.path.expanduser('~') + '/.internalblue'
+
+    if not os.path.exists(data_directory):
+        os.mkdir(data_directory)
+
+    from internalblue.socket_hooks import hook, ReplaySocket
+    hook(HCICore, ReplaySocket, filename=args.replay)
+
+    connection_methods = [HCICore(log_level='info', data_directory=data_directory, replay=True)]
+
+    devices = []  # type: List[DeviceTuple]
+    devices = connection_methods[0].device_list()
+
+    device = devices[0]
+    reference = device[0]
+    reference.interface = device[1]
+    reference.connect()
+
+    information = reference.readHeapInformation()
+    print(information)
+
+    nose.tools.assert_equal(information, dummy)
+
+    reference.shutdown()

tests/test_heap_old.py

@@ -0,0 +1,234 @@
+from __future__ import print_function
+from internalblue.cli import _parse_argv
+from internalblue.adbcore import ADBCore
+
+import os
+import nose
+
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple
+except ImportError:
+    pass
+
+
+def test_info_heap_old():
+    dummy = [
+        {
+            'index':0,
+            'buffer_headers': {
+                2194080: 0,
+                2193828: 2121160,
+                2193864: 2194008,
+                2193900: 2194044,
+                2193936: 2193864,
+                2193972: 2121160,
+                2194008: 2193900,
+                2194044: 2194080
+            },
+            'capacity': 8,
+            'address': 2121160,
+            'next': 2121208,
+            'memory_size': 288,
+            'waitlist_length': 0,
+            'buffer_list': 2193828,
+            'memory': 2193828,
+            'buffer_size': 32,
+            'prev': 2157672,
+            'list_length': 7,
+            'thread_waitlist': 0
+        },
+        {
+            'index': 1,
+            'buffer_headers': {
+                2194592: 0,
+                2194116: 2194184,
+                2194184: 2194252,
+                2194252: 2194320,
+                2194320: 2194388,
+                2194388: 2194456,
+                2194456: 2194524,
+                2194524: 2194592
+            },
+            'capacity': 8,
+            'address': 2121208,
+            'next': 2121256,
+            'memory_size': 544,
+            'waitlist_length': 0,
+            'buffer_list': 2194184,
+            'memory': 2194116,
+            'buffer_size': 64,
+            'prev': 2121160,
+            'list_length': 7,
+            'thread_waitlist': 0
+        },
+        {
+            'index': 2,
+            'buffer_headers': {
+                2196000: 2196268,
+                2197072: 0,
+                2194660: 2194928,
+                2195464: 2195732,
+                2196268: 2196536,
+                2194928: 2195196,
+                2195732: 2196000,
+                2196536: 2196804,
+                2196804: 2197072,
+                2195196: 2195464
+            },
+            'capacity': 10,
+            'address': 2121256,
+            'next': 2121352,
+            'memory_size': 2680,
+            'waitlist_length': 0,
+            'buffer_list': 2194660,
+            'memory': 2194660,
+            'buffer_size': 264,
+            'prev': 2121208,
+            'list_length': 10,
+            'thread_waitlist': 0
+        },
+        {
+            'index': 3,
+            'buffer_headers': {
+                2214480: 2215548,
+                2215548: 2216616,
+                2216616: 0,
+                2213412: 2214480
+            },
+            'capacity': 4,
+            'address': 2121352,
+            'next': 2121304,
+            'memory_size': 4272,
+            'waitlist_length': 0,
+            'buffer_list': 2213412,
+            'memory': 2213412,
+            'buffer_size': 1064,
+            'prev': 2121256,
+            'list_length': 4,
+            'thread_waitlist': 0
+        },
+        {
+            'index': 4,
+            'buffer_headers': {
+                2234124: 0,
+                2231932: 2233028,
+                2224260: 2225356,
+                2219876: 2220972,
+                2226452: 2227548,
+                2223164: 2224260,
+                2228644: 2229740,
+                2220972: 2222068,
+                2225356: 2226452,
+                2230836: 2231932,
+                2233028: 2234124,
+                2222068: 2223164,
+                2227548: 2228644,
+                2217684: 2218780,
+                2218780: 2219876,
+                2229740: 2230836
+            },
+            'capacity': 16,
+            'address': 2121304,
+            'next': 2157624,
+            'memory_size': 17536,
+            'waitlist_length': 0,
+            'buffer_list': 2217684,
+            'memory': 2217684,
+            'buffer_size': 1092,
+            'prev': 2121352,
+            'list_length': 16,
+            'thread_waitlist': 0
+        },
+        {
+            'index': 5,
+            'buffer_headers': {
+                2235264: 2235308,
+                2235616: 2235660,
+                2235396: 2235440,
+                2235528: 2235572,
+                2235660: 2235704,
+                2235308: 2235352,
+                2235440: 2235484,
+                2235704: 2235748,
+                2235792: 2235836,
+                2235220: 2235264,
+                2235748: 2235792,
+                2235352: 2235396,
+                2235572: 2235616,
+                2235836: 0,
+                2235484: 2235528
+            },
+            'capacity': 15,
+            'address': 2157624,
+            'next': 2157672,
+            'memory_size': 660,
+            'waitlist_length': 0,
+            'buffer_list': 2235220,
+            'memory': 2235220,
+            'buffer_size': 40,
+            'prev': 2121304,
+            'list_length': 15,
+            'thread_waitlist': 0
+        },
+        {
+            'index': 6,
+            'buffer_headers': {
+                2236096: 2236132,
+                2236240: 2236276,
+                2236132: 2236168,
+                2236384: 0,
+                2235880: 2235916,
+                2236204: 2236240,
+                2236348: 2236384,
+                2235916: 2235952,
+                2235952: 2235988,
+                2236168: 2236204,
+                2236312: 2236348,
+                2235988: 2236024,
+                2236024: 2236060,
+                2236276: 2236312,
+                2236060: 2236096
+            },
+            'capacity': 15,
+            'address': 2157672,
+            'next': 2121160,
+            'memory_size': 540,
+            'waitlist_length': 0,
+            'buffer_list': 2235880,
+            'memory': 2235880,
+            'buffer_size': 32,
+            'prev': 2157624,
+            'list_length': 15,
+            'thread_waitlist': 0
+        }]
+
+    trace = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                         'traces/adbcore/dictionary_tests/info_heap_old.trace')
+    args = _parse_argv('')
+    args.device = 'adb_replay'
+    args.replay = trace
+
+    data_directory = os.path.expanduser('~') + '/.internalblue'
+
+    if not os.path.exists(data_directory):
+        os.mkdir(data_directory)
+
+    from internalblue.socket_hooks import hook, ReplaySocket
+    hook(ADBCore, ReplaySocket, filename=args.replay)
+
+    connection_methods = [ADBCore(log_level='info', data_directory=data_directory, replay=True)]
+
+    devices = []  # type: List[DeviceTuple]
+    devices = connection_methods[0].device_list()
+
+    device = devices[0]
+    reference = device[0]
+    reference.interface = device[1]
+    reference.connect()
+
+    information = reference.readHeapInformation()
+    print(information)
+
+    nose.tools.assert_equal(information, dummy)
+
+    reference.shutdown()

tests/test_info_conn_7.py

@@ -0,0 +1,52 @@
+from __future__ import print_function
+from internalblue.cli import _parse_argv
+from internalblue.adbcore import ADBCore
+from internalblue.objects.connection_information import ConnectionInformation
+
+import os
+import nose
+
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple
+    from internalblue import DeviceTuple
+except ImportError:
+    pass
+
+
+def test_info_conn_7():
+    dummy = ConnectionInformation(7, bytearray.fromhex('0023023a1a2e'), 0, True, 0xc,
+                                  bytearray.fromhex('e98a5eaaff39ecb5ce4447590dfb73a4'), 16,
+                                  bytearray.fromhex('dbea2d9c47bc1aa6afe664ff31591aa6'), -87,
+                                  bytearray.fromhex('0a00c821ffff8ffa'), bytearray.fromhex('9bff598701000000'),
+                                  bytearray.fromhex('00'))
+
+    trace = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                         'traces/adbcore/dictionary_tests/info_conn_7.trace')
+    args = _parse_argv('')
+    args.device = 'adb_replay'
+    args.replay = trace
+
+    data_directory = os.path.expanduser('~') + '/.internalblue'
+
+    if not os.path.exists(data_directory):
+        os.mkdir(data_directory)
+
+    from internalblue.socket_hooks import hook, ReplaySocket
+    hook(ADBCore, ReplaySocket, filename=args.replay)
+
+    connection_methods = [ADBCore(log_level='info', data_directory=data_directory, replay=True)]
+
+    devices = []  # type: List[DeviceTuple]
+    devices = connection_methods[0].device_list()
+
+    device = devices[0]
+    reference = device[0]
+    reference.interface = device[1]
+    reference.connect()
+
+    information = reference.readConnectionInformation(7)
+    print(information)
+
+    nose.tools.assert_dict_equal(vars(information), vars(dummy))
+
+    reference.shutdown()

tests/test_info_conn_9.py

@@ -0,0 +1,50 @@
+from __future__ import print_function
+from internalblue.cli import _parse_argv
+from internalblue.adbcore import ADBCore
+from internalblue.objects.connection_information import ConnectionInformation
+
+import os
+import nose
+
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple
+except ImportError:
+    pass
+
+
+def test_info_conn_9():
+    dummy = ConnectionInformation(9, bytearray.fromhex('000000000000'), 0, False, 12,
+                                  bytearray.fromhex('00000000000000000000000000000000'), 0, b'', -87,
+                                  bytearray.fromhex('0000000000000000'),
+                                  bytearray.fromhex('0000000000000000'), bytearray.fromhex('00'))
+
+    trace = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                         'traces/adbcore/dictionary_tests/info_conn_9.trace')
+    args = _parse_argv('')
+    args.device = 'adb_replay'
+    args.replay = trace
+
+    data_directory = os.path.expanduser('~') + '/.internalblue'
+
+    if not os.path.exists(data_directory):
+        os.mkdir(data_directory)
+
+    from internalblue.socket_hooks import hook, ReplaySocket
+    hook(ADBCore, ReplaySocket, filename=args.replay)
+
+    connection_methods = [ADBCore(log_level='info', data_directory=data_directory, replay=True)]
+
+    devices = []  # type: List[DeviceTuple]
+    devices = connection_methods[0].device_list()
+
+    device = devices[0]
+    reference = device[0]
+    reference.interface = device[1]
+    reference.connect()
+
+    information = reference.readConnectionInformation(9)
+    print(information)
+
+    nose.tools.assert_dict_equal(vars(information), vars(dummy))
+
+    reference.shutdown()

tests/test_queue.py

@@ -0,0 +1,63 @@
+from __future__ import print_function
+from internalblue.cli import _parse_argv
+from internalblue.adbcore import ADBCore
+from internalblue.objects.queue_element import QueueElement
+
+import os
+import nose
+
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple
+except ImportError:
+    pass
+
+def test_info_queue():
+    dummy = [
+        QueueElement(0, 2123152, 4, 16, 0, 16, 2123208, 2123272, 2123268, 2123268, 0, 0, 2123332, 2141676, 'tran_HCIEvent'),
+        QueueElement(1, 2123332, 8, 31, 0, 31, 2123388, 2123636, 2123436, 2123436, 0, 0, 2123636, 2123152, 'tran_ACLData'),
+        QueueElement(2, 2123636, 4, 3, 0, 3, 2123692, 2123704, 2123692, 2123692, 0, 0, 2123704, 2123332, 'tran_SCOData'),
+        QueueElement(3, 2123704, 4, 31, 0, 31, 2123760, 2123884, 2123760, 2123760, 0, 0, 2123884, 2123636, 'tran_UartBridgeNonHCIEvent'),
+        QueueElement(4, 2123884, 4, 20, 0, 20, 2123940, 2124020, 2124000, 2124000, 0, 0, 2124020, 2123704, 'tran_DiagData'),
+        QueueElement(5, 2124020, 8, 8, 0, 8, 2124076, 2124140, 2124076, 2124076, 0, 0, 2124140, 2123884, 'tran_HIDUsbKBEvt'),
+        QueueElement(6, 2124140, 8, 6, 0, 6, 2124196, 2124244, 2124196, 2124196, 0, 0, 2124244, 2124020, 'tran_HIDUsbMSEvt'),
+        QueueElement(7, 2124244, 8, 1, 0, 1, 2100496, 2100504, 2100496, 2100496, 0, 0, 2124300, 2124140, 'tran_HIDUsbMSCtrl'),
+        QueueElement(8, 2124300, 8, 1, 0, 1, 2100504, 2100512, 2100504, 2100504, 0, 0, 2124356, 2124244, 'tran_HIDUsbKBCtrl'),
+        QueueElement(9, 2124356, 8, 32, 0, 32, 2124412, 2124668, 2124412, 2124412, 0, 0, 2110352, 2124300, 'tran_HidAuxData'),
+        QueueElement(10, 2110352, 8, 12, 0, 12, 2192284, 2192380, 2192300, 2192300, 0, 0, 2120560, 2124356, 'lm_Cmd'),
+        QueueElement(11, 2120560, 4, 8, 0, 8, 2192380, 2192412, 2192400, 2192400, 0, 0, 2110408, 2110352, 'hci_HciCommand'),
+        QueueElement(12, 2110408, 8, 19, 0, 19, 2192412, 2192564, 2192412, 2192412, 0, 0, 2118068, 2120560, 'lm_deferredAction'),
+        QueueElement(13, 2118068, 8, 6, 0, 6, 2192564, 2192612, 2192564, 2192564, 0, 0, 2141588, 2110408, 'lrmmsm_cmd'),
+        QueueElement(14, 2141588, 4, 8, 0, 8, 2141644, 2141676, 2141644, 2141644, 0, 0, 2141676, 2118068, 'liteHostEvent'),
+        QueueElement(15, 2141676, 4, 16, 0, 16, 2141732, 2141796, 2141732, 2141732, 0, 0, 2123152, 2141588, 'litehostRcvdL2capData')
+    ]
+
+    trace = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                         'traces/adbcore/dictionary_tests/info_queue.trace')
+    args = _parse_argv('')
+    args.device = 'adb_replay'
+    args.replay = trace
+
+    data_directory = os.path.expanduser('~') + '/.internalblue'
+
+    if not os.path.exists(data_directory):
+        os.mkdir(data_directory)
+
+    from internalblue.socket_hooks import hook, ReplaySocket
+    hook(ADBCore, ReplaySocket, filename=args.replay)
+
+    connection_methods = [ADBCore(log_level='info', data_directory=data_directory, replay=True)]
+
+    devices = []  # type: List[DeviceTuple]
+    devices = connection_methods[0].device_list()
+
+    device = devices[0]
+    reference = device[0]
+    reference.interface = device[1]
+    reference.connect()
+
+    information = reference.readQueueInformation()
+    print(information)
+
+    nose.tools.assert_equal([vars(element) for element in information], [vars(element) for element in dummy])
+
+    reference.shutdown()

tests/traces/__init__.py

@@ -0,0 +1,63 @@
+from __future__ import print_function
+from __future__ import absolute_import
+
+from .testwrapper import trace_test, get_trace_path_cmd_tuple
+
+
+import os
+tracedir = os.path.dirname(__file__)
+
+#cores = ['macoscore', 'ioscore', 'adbcore', 'hcicore']
+
+
+
+
+import unittest
+
+
+def generate_test_suite_from_traces():
+
+    def generate_test_from_file(core, tracefile):
+        tracepath, cmd = get_trace_path_cmd_tuple(core, tracefile)
+
+        def test():
+            print("Running test %s " % (tracefile[:-6]))
+            trace_test(core, tracepath, cmd)
+
+        # Rename the function to the tracefile name without .trace suffix
+        test.__name__ = tracefile[:-6]
+        if cmd:
+            return test
+        else:
+            return unittest.skip("No command specified in trace {}".format(tracepath))(test)
+
+    suite = unittest.TestSuite()
+    for core in os.listdir(tracedir):
+        if os.path.isdir(os.path.join(tracedir,core)):
+            core_suite = unittest.TestSuite()
+            for tracefile in os.listdir(os.path.join(tracedir, core)):
+                if tracefile.endswith(".trace"):
+                    core_suite.addTest(
+                        unittest.FunctionTestCase(generate_test_from_file(core, tracefile), description=tracefile))
+            suite.addTest(core_suite)
+
+    return suite
+    # test_all_traces()
+
+def load_tests(loader, standard_tests, n):
+    """
+    This method is called by test frameworks to supply a testsuite instead of the test framework collecting them itself.
+    This allows use to automatically generate a proper test for each trace in the subdirectory that has a command specified.
+    Those tests are then run by the framework in the usual way which integrates with IDEs
+    TODO: Document PyCharm Setup
+    """
+
+    trace_suite = generate_test_suite_from_traces()
+    return trace_suite
+
+if __name__ == '__main__':
+    suite = generate_test_suite_from_traces()
+    unittest.TextTestRunner().run(suite)
+
+
+

tests/traces/adbcore/dictionary_tests/info_conn_7.trace

@@ -0,0 +1,21 @@
+TX 010300011000
+RX 0000000400000004000000020000000000e26b46e2c309cc
+RX 01011000
+RX 0000000f0000000f000000030000000000e26b46e2c3274f
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc05b0402000fb
+RX 000000090000000900000002
+RX 0000000000e26b46e2d06c12
+RX 014dfc05b0402000fb
+RX 0000010200000102000000030000000000e26b46
+RX e2d093f7
+RX 040eff014dfc0007000000000000000000000000000007000000000000000000007711572d980700000000000010002e1a3a022300feb10a00c821ffff8ffa9bff59870100000000000000000000000000000000000000000000000000008d0500fa0a401f0000401f00000c001adddbea2d9c47bc1aa6afe664ff31591aa6e98a5eaaff39ecb5ce4447590dfb73a4161203cd6e77be6a4bcfb3ee52d3e2c40000000028000404000000130000001000000000020001003c002003001800009c7e1200b00402000200000002000101010200000000000000000000ffffffffffffffff0000000100000000000005f8ff001add0020000000000015d1000000000000
+TX 0108004dfc05ab41200051
+RX 000000090000000900000002
+RX 0000000000e26b46e2d18faa
+RX 014dfc05ab41200051
+RX 0000005800000058000000030000000000e26b46e2d1ade2
+RX 040e55014dfc000000000000000000000000000000000000a4000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000001000000
+Socket closed

tests/traces/adbcore/dictionary_tests/info_conn_9.trace

@@ -0,0 +1,24 @@
+#info connections
+TX 010300011000
+RX 0000000400000004000000020000000000e269c211af9287
+RX 01011000
+RX 0000000f0000000f000000030000000000e269c211afc606
+RX 040e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc0548432000fb
+RX 0000000900000009000000020000000000e269c2
+RX 11cde3be
+RX 014dfc0548432000fb
+RX 00000102
+RX 000001020000000300000000
+RX 00e269c211ce175c
+RX 04
+RX 0eff014dfc000900000000000000000000000000000000000000000000000000777700c91000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000007d0000007d00000c001eff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002800000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000000100000000000000f0ff0000000000000000000001c4000000000000
+TX 0108004dfc054344200051
+RX 0000000900000009000000020000000000e269c2
+RX 11cf5a52
+RX 014dfc054344200051
+RX 000000580000005800000003
+RX 0000000000e269c211cf8917
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+Socket closed

tests/traces/adbcore/dictionary_tests/info_heap_old.trace

@@ -0,0 +1,685 @@
+# info heap
+TX 010300011000
+RX 0000000400000004000000020000000000e269c200a6dc56
+RX 01011000
+RX 0000000f0000000f000000030000000000e269c2
+RX 00a717ec
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc059430200004
+RX 000000030000000300000003
+RX 0000000000e269c200a87965
+RX 07f001
+RX 00000009000000090000000200000000
+RX 00e269c200a8e193
+RX 01
+RX 4dfc059430200004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00a918e2
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05c85d200030
+RX 000000090000000900000002
+RX 0000000000e269c200aab793
+RX 014dfc05c85d200030
+RX 00000037
+RX 000000370000000300000000
+RX 00e269c200aaf0ec
+RX 04
+RX 0e34014dfc00434f4c42000000000700000008000000a4792100a479210020010000200000000000000000000000f85d200068ec2000
+TX 0108004dfc05a479210004
+RX 000000090000000900000002
+RX 0000000000e269c200acb1ba
+RX 014dfc05a479210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200ace5c2
+RX 04
+RX 0e08014dfc00c85d2000
+TX 0108004dfc05c879210004
+RX 000000090000000900000002
+RX 0000000000e269c200ae2501
+RX 014dfc05c879210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200ae5915
+RX 04
+RX 0e08014dfc00587a2100
+TX 0108004dfc05ec79210004
+RX 0000000900000009000000020000000000e269c200b01eae
+RX 01
+RX 4dfc05ec79210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200b04d6c
+RX 04
+RX 0e08014dfc007c7a2100
+TX 0108004dfc05107a210004
+RX 0000000900000009000000020000000000e269c200b19061
+RX 014dfc05107a210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200b1c4f3
+RX 04
+RX 0e08014dfc00c8792100
+TX 0108004dfc05347a210004
+RX 0000000900000009000000020000000000e269c200b38d00
+RX 01
+RX 4dfc05347a210004
+RX 0000000b0000000b
+RX 000000030000000000e269c200b3bbaa
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05587a210004
+RX 0000000900000009000000020000000000e269c200b58252
+RX 014dfc05587a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00b5b18b
+RX 040e08014dfc00ec792100
+TX 0108004dfc057c7a210004
+RX 0000000900000009000000020000000000e269c200b6f455
+RX 014dfc057c7a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00b728c4
+RX 040e08014dfc00a07a2100
+TX 0108004dfc05a07a210004
+RX 000000090000000900000002
+RX 0000000000e269c200b8f1d6
+RX 014dfc05a07a210004
+RX 0000000b0000000b000000030000000000e269c2
+RX 00b92612
+RX 040e08014dfc0000000000
+TX 0108004dfc05f85d200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00ba65be
+RX 014dfc05f85d200030
+RX 00000037000000370000000300000000
+RX 00e269c200ba9b76
+RX 04
+RX 0e34014dfc00434f4c42000000000700000008000000087b2100c47a210020020000400000000000000000000000285e2000c85d2000
+TX 0108004dfc05c47a210004
+RX 000000090000000900000002
+RX 0000000000e269c200bc6390
+RX 014dfc05c47a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00bc987e
+RX 04
+RX 0e08014dfc00087b2100
+TX 0108004dfc05087b210004
+RX 0000000900000009000000020000000000e269c2
+RX 00bdd708
+RX 014dfc05087b210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200be075f
+RX 04
+RX 0e08014dfc004c7b2100
+TX 0108004dfc054c7b210004
+RX 0000000900000009000000020000000000e269c200bfd07f
+RX 014dfc054c7b210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00bfffe2
+RX 040e08014dfc00907b2100
+TX 0108004dfc05907b210004
+RX 000000090000000900000002
+RX 0000000000e269c200c1c264
+RX 014dfc05907b210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00c1fba1
+RX 040e08014dfc00d47b2100
+TX 0108004dfc05d47b210004
+RX 000000090000000900000002
+RX 0000000000e269c200c339f3
+RX 014dfc05d47b210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00c36f64
+RX 040e08014dfc00187c2100
+TX 0108004dfc05187c210004
+RX 0000000900000009000000020000000000e269c200c53386
+RX 014dfc05187c210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00c56249
+RX 040e08014dfc005c7c2100
+TX 0108004dfc055c7c210004
+RX 0000000900000009000000020000000000e269c2
+RX 00c6a64c
+RX 014dfc055c7c210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200c6d51e
+RX 04
+RX 0e08014dfc00a07c2100
+TX 0108004dfc05a07c210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00c8a176
+RX 014dfc05a07c210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200c8daef
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc05285e200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00ca1661
+RX 014dfc05285e200030
+RX 000000370000003700000003
+RX 0000000000e269c200ca4c0b
+RX 040e34014dfc00434f4c42000000000a0000000a000000e47c2100e47c2100780a0000080100000000000000000000885e2000f85d2000
+TX 0108004dfc05e47c210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00cc13aa
+RX 014dfc05e47c210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200cc49c8
+RX 04
+RX 0e08014dfc00f07d2100
+TX 0108004dfc05f07d210004
+RX 00000009000000090000000200000000
+RX 00e269c200ce084a
+RX 014dfc05f07d210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00ce3d02
+RX 040e08014dfc00fc7e2100
+TX 0108004dfc05fc7e210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00cf7abc
+RX 014dfc05fc7e210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200cfafff
+RX 04
+RX 0e08014dfc0008802100
+TX 0108004dfc050880210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00d1718e
+RX 014dfc050880210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200d1ad02
+RX 040e08014dfc0014812100
+TX 0108004dfc051481210004
+RX 0000000900000009000000020000000000e269c200d2e49d
+RX 01
+RX 4dfc051481210004
+RX 0000000b0000000b
+RX 000000030000000000e269c200d313fc
+RX 040e08014dfc0020822100
+TX 0108004dfc052082210004
+RX 0000000900000009000000020000000000e269c2
+RX 00d4dfc6
+RX 014dfc052082210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200d50e59
+RX 040e08014dfc002c832100
+TX 0108004dfc052c83210004
+RX 00000009000000090000000200000000
+RX 00e269c200d65308
+RX 01
+RX 4dfc052c83210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00d68806
+RX 040e08014dfc0038842100
+TX 0108004dfc053884210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00d84aba
+RX 014dfc053884210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200d88584
+RX 040e08014dfc0044852100
+TX 0108004dfc054485210004
+RX 0000000900000009000000020000000000e269c2
+RX 00da42d6
+RX 014dfc054485210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200da7651
+RX 040e08014dfc0050862100
+TX 0108004dfc055086210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00dbba9e
+RX 014dfc055086210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200dbf538
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc05885e200030
+RX 00000009000000090000000200000000
+RX 00e269c200ddb037
+RX 01
+RX 4dfc05885e200030
+RX 000000370000003700000003
+RX 0000000000e269c200dde9b6
+RX 040e34014dfc00434f4c4200000000040000000400000024c6210024c62100b0100000280400000000000000000000585e2000285e2000
+TX 0108004dfc0524c6210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00df268a
+RX 014dfc0524c6210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200df5cd7
+RX 040e08014dfc0050ca2100
+TX 0108004dfc0550ca210004
+RX 0000000900000009000000020000000000e269c2
+RX 00e11eb6
+RX 01
+RX 4dfc0550ca210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200e15819
+RX 040e08014dfc007cce2100
+TX 0108004dfc057cce210004
+RX 00000009000000090000000200000000
+RX 00e269c200e29334
+RX 01
+RX 4dfc057cce210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00e2c73e
+RX 040e08014dfc00a8d22100
+TX 0108004dfc05a8d2210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00e4925e
+RX 014dfc05a8d2210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200e4c673
+RX 040e08014dfc0000000000
+TX 0108004dfc05585e200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00e5ff65
+RX 014dfc05585e200030
+RX 000000370000003700000003
+RX 0000000000e269c200e63326
+RX 040e34014dfc00434f4c42000000001000000010000000d4d62100d4d621008044000044040000000000000000000038ec2000885e2000
+TX 0108004dfc05d4d6210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00e7fcce
+RX 014dfc05d4d6210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200e8313f
+RX 040e08014dfc001cdb2100
+TX 0108004dfc051cdb210004
+RX 0000000900000009000000020000000000e269c200e9f3c0
+RX 014dfc051cdb210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00ea223f
+RX 040e08014dfc0064df2100
+TX 0108004dfc0564df210004
+RX 00000009000000090000000200000000
+RX 00e269c200eb6947
+RX 01
+RX 4dfc0564df210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200eb9dc8
+RX 04
+RX 0e08014dfc00ace32100
+TX 0108004dfc05ace3210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00ed6025
+RX 014dfc05ace3210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00edb820
+RX 040e08014dfc00f4e72100
+TX 0108004dfc05f4e7210004
+RX 00000009000000090000000200000000
+RX 00e269c200eeaa84
+RX 014dfc05f4e7210004
+RX 0000000b0000000b000000030000000000e269c200eeb23c
+RX 04
+RX 0e08014dfc003cec2100
+TX 0108004dfc053cec210004
+RX 0000000900000009
+RX 000000020000000000e269c200ef25f0
+RX 01
+RX 4dfc053cec210004
+RX 0000000b
+RX 0000000b000000030000000000e269c200ef2e26
+RX 04
+RX 0e08014dfc0084f02100
+TX 0108004dfc0584f0210004
+RX 0000000900000009000000020000000000e269c200efa285
+RX 014dfc0584f0210004
+RX 0000000b
+RX 0000000b000000030000000000e269c200efa979
+RX 040e08014dfc00ccf42100
+TX 0108004dfc05ccf4210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00f0207c
+RX 014dfc05ccf4210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200f028c8
+RX 04
+RX 0e08014dfc0014f92100
+TX 0108004dfc0514f9210004
+RX 0000000900000009000000020000000000e269c200f0b8fd
+RX 014dfc0514f9210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200f0bf4a
+RX 040e08014dfc005cfd2100
+TX 0108004dfc055cfd210004
+RX 00000009000000090000000200000000
+RX 00e269c200f11c7d
+RX 01
+RX 4dfc055cfd210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200f12aa4
+RX 040e08014dfc00a4012200
+TX 0108004dfc05a401220004
+RX 0000000900000009000000020000000000e269c200f1946c
+RX 014dfc05a401220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200f19f40
+RX 040e08014dfc00ec052200
+TX 0108004dfc05ec05220004
+RX 0000000900000009000000020000000000e269c200f20f44
+RX 01
+RX 4dfc05ec05220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200f21b6a
+RX 04
+RX 0e08014dfc00340a2200
+TX 0108004dfc05340a220004
+RX 0000000900000009000000020000000000e269c200f29be7
+RX 014dfc05340a220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00f2b3bd
+RX 040e08014dfc007c0e2200
+TX 0108004dfc057c0e220004
+RX 00000009
+RX 00000009
+RX 0000000200000000
+RX 00e269c200f3a7c6
+RX 01
+RX 4dfc057c0e220004
+RX 0000000b0000000b000000030000000000e269c2
+RX 00f4951f
+RX 040e08014dfc00c4122200
+TX 0108004dfc05c412220004
+RX 0000000900000009
+RX 000000020000000000e269c200f637e5
+RX 014dfc05c412220004
+RX 0000000b0000000b000000030000000000e269c200f63f91
+RX 040e08014dfc000c172200
+TX 0108004dfc050c17220004
+RX 00000009
+RX 000000090000000200000000
+RX 00e269c200f6f156
+RX 014dfc050c17220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200f6f966
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc0538ec200030
+RX 00000009000000090000000200000000
+RX 00e269c200f76de0
+RX 014dfc0538ec200030
+RX 0000003700000037000000030000000000e269c200f7757d
+RX 040e34014dfc00434f4c42000000000f0000000f000000541b2200541b22009402000028000000000000000000000068ec2000585e2000
+TX 0108004dfc05541b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00f8133d
+RX 014dfc05541b220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200f83a20
+RX 04
+RX 0e08014dfc00801b2200
+TX 0108004dfc05801b220004
+RX 0000000900000009000000020000000000e269c200f909ee
+RX 014dfc05801b220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200f935e2
+RX 04
+RX 0e08014dfc00ac1b2200
+TX 0108004dfc05ac1b220004
+RX 0000000900000009000000020000000000e269c2
+RX 00fb146c
+RX 014dfc05ac1b220004
+RX 0000000b
+RX 0000000b00000003
+RX 0000000000e269c200fb4327
+RX 040e08014dfc00d81b2200
+TX 0108004dfc05d81b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00fd0682
+RX 014dfc05d81b220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200fd3fca
+RX 04
+RX 0e08014dfc00041c2200
+TX 0108004dfc05041c220004
+RX 00000009000000090000000200000000
+RX 00e269c200fe7d8e
+RX 01
+RX 4dfc05041c220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200feb0d4
+RX 040e08014dfc00301c2200
+TX 0108004dfc05301c220004
+RX 0000000900000009000000020000000000e269c2
+RX 010074cc
+RX 014dfc05301c220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c20100a76b
+RX 04
+RX 0e08014dfc005c1c2200
+TX 0108004dfc055c1c220004
+RX 0000000900000009000000020000000000e269c20101eacb
+RX 014dfc055c1c220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201021779
+RX 04
+RX 0e08014dfc00881c2200
+TX 0108004dfc05881c220004
+RX 0000000900000009000000020000000000e269c20103e6c3
+RX 014dfc05881c220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201041515
+RX 04
+RX 0e08014dfc00b41c2200
+TX 0108004dfc05b41c220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 01055aa2
+RX 014dfc05b41c220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201058f0e
+RX 040e08014dfc00e01c2200
+TX 0108004dfc05e01c220004
+RX 000000090000000900000002
+RX 0000000000e269c201075199
+RX 014dfc05e01c220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201078a8c
+RX 04
+RX 0e08014dfc000c1d2200
+TX 0108004dfc050c1d220004
+RX 0000000900000009000000020000000000e269c2
+RX 010948a2
+RX 014dfc050c1d220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201097c0d
+RX 04
+RX 0e08014dfc00381d2200
+TX 0108004dfc05381d220004
+RX 0000000900000009
+RX 000000020000000000e269c2010ac2b3
+RX 014dfc05381d220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2010afeef
+RX 04
+RX 0e08014dfc00641d2200
+TX 0108004dfc05641d220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 010cbc41
+RX 014dfc05641d220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2010cefe5
+RX 040e08014dfc00901d2200
+TX 0108004dfc05901d220004
+RX 00000009000000090000000200000000
+RX 00e269c2010e2df1
+RX 01
+RX 4dfc05901d220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2010e61ea
+RX 040e08014dfc00bc1d2200
+TX 0108004dfc05bc1d220004
+RX 000000090000000900000002
+RX 0000000000e269c20110231e
+RX 014dfc05bc1d220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201105c92
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc0568ec200030
+RX 0000000900000009000000020000000000e269c2
+RX 01119816
+RX 014dfc0568ec200030
+RX 00000037000000370000000300000000
+RX 00e269c20111c667
+RX 04
+RX 0e34014dfc00434f4c42000000000f0000000f000000e81d2200e81d22001c020000200000000000000000000000c85d200038ec2000
+TX 0108004dfc05e81d220004
+RX 00000009000000090000000200000000
+RX 00e269c201138f25
+RX 01
+RX 4dfc05e81d220004
+RX 0000000b0000000b
+RX 000000030000000000e269c20113c768
+RX 040e08014dfc000c1e2200
+TX 0108004dfc050c1e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 011507e7
+RX 014dfc050c1e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201153d26
+RX 04
+RX 0e08014dfc00301e2200
+TX 0108004dfc05301e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 0116fe0e
+RX 014dfc05301e220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201173734
+RX 04
+RX 0e08014dfc00541e2200
+TX 0108004dfc05541e220004
+RX 0000000900000009000000020000000000e269c20118f296
+RX 014dfc05541e220004
+RX 0000000b0000000b
+RX 000000030000000000e269c2011926ef
+RX 040e08014dfc00781e2200
+TX 0108004dfc05781e220004
+RX 0000000900000009000000020000000000e269c2011a6bbe
+RX 014dfc05781e220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2011a9958
+RX 04
+RX 0e08014dfc009c1e2200
+TX 0108004dfc059c1e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 011c676b
+RX 014dfc059c1e220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2011c9b6e
+RX 040e08014dfc00c01e2200
+TX 0108004dfc05c01e220004
+RX 0000000900000009000000020000000000e269c2
+RX 011dda94
+RX 014dfc05c01e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c2011e0829
+RX 04
+RX 0e08014dfc00e41e2200
+TX 0108004dfc05e41e220004
+RX 0000000900000009000000020000000000e269c2011fd393
+RX 014dfc05e41e220004
+RX 0000000b0000000b
+RX 0000000300000000
+RX 00e269c201200234
+RX 040e08014dfc00081f2200
+TX 0108004dfc05081f220004
+RX 0000000900000009000000020000000000e269c2
+RX 012145f7
+RX 014dfc05081f220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c20121a431
+RX 04
+RX 0e08014dfc002c1f2200
+TX 0108004dfc052c1f220004
+RX 000000090000000900000002
+RX 0000000000e269c201230eec
+RX 014dfc052c1f220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201231658
+RX 040e08014dfc00501f2200
+TX 0108004dfc05501f220004
+RX 0000000900000009
+RX 000000020000000000e269c20124484f
+RX 014dfc05501f220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201244f7a
+RX 040e08014dfc00741f2200
+TX 0108004dfc05741f220004
+RX 00000009
+RX 00000009000000020000000000e269c201250543
+RX 01
+RX 4dfc05741f220004
+RX 0000000b0000000b000000030000000000e269c2
+RX 01250d7b
+RX 040e08014dfc00981f2200
+TX 0108004dfc05981f220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 0125e492
+RX 014dfc05981f220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c201260ab3
+RX 040e08014dfc00bc1f2200
+TX 0108004dfc05bc1f220004
+RX 0000000900000009000000020000000000e269c2
+RX 01276da0
+RX 014dfc05bc1f220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201279c46
+RX 040e08014dfc00e01f2200
+TX 0108004dfc05e01f220004
+RX 0000000900000009000000020000000000e269c2
+RX 0128e461
+RX 014dfc05e01f220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2012914b3
+RX 040e08014dfc0000000000
+Socket closed

tests/traces/adbcore/dictionary_tests/info_queue.trace

@@ -0,0 +1,148 @@
+# info queue
+TX 010300011000
+RX 0000000400000004000000020000000000e269c2663770fc
+RX 01011000
+RX 0000000f0000000f000000030000000000e269c26637a4a7
+RX 040e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc057c30200004
+RX 00000003000000030000000300000000
+RX 00e269c266390c8a
+RX 07f001
+RX 00000009
+RX 000000090000000200000000
+RX 00e269c2663974da
+RX 01
+RX 4dfc057c30200004
+RX 0000000b0000000b
+RX 000000030000000000e269c26639ac63
+RX 040e08014dfc0090652000
+TX 0108004dfc059065200038
+RX 000000090000000900000002
+RX 0000000000e269c2
+RX 663b4f1a
+RX 014dfc059065200038
+RX 0000003f0000003f0000000300000000
+RX 00e269c2663b83d8
+RX 040e3c014dfc00554555510000000001000000100000000000000010000000c8652000086620000466200004662000000000000000000044662000ecad2000
+TX 0108004dfc054466200038
+RX 000000090000000900000002
+RX 0000000000e269c2663d419c
+RX 014dfc054466200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 663d7aab
+RX 040e3c014dfc005545555100000000020000001f000000000000001f0000007c66200074672000ac662000ac66200000000000000000007467200090652000
+TX 0108004dfc057467200038
+RX 0000000900000009000000020000000000e269c2
+RX 663ebb9e
+RX 014dfc057467200038
+RX 0000003f0000003f00000003
+RX 0000000000e269c2663eeac6
+RX 040e3c014dfc00554555510000000001000000030000000000000003000000ac672000b8672000ac672000ac6720000000000000000000b867200044662000
+TX 0108004dfc05b867200038
+RX 0000000900000009000000020000000000e269c26640af70
+RX 01
+RX 4dfc05b867200038
+RX 0000003f0000003f
+RX 000000030000000000e269c2
+RX 6640e3ed
+RX 040e3c014dfc005545555100000000010000001f000000000000001f000000f06720006c682000f0672000f067200000000000000000006c68200074672000
+TX 0108004dfc056c68200038
+RX 0000000900000009000000020000000000e269c26642a534
+RX 014dfc056c68200038
+RX 0000003f
+RX 0000003f0000000300000000
+RX 00e269c26642d8cd
+RX 04
+RX 0e3c014dfc00554555510000000001000000140000000000000014000000a4682000f4682000e0682000e06820000000000000000000f4682000b8672000
+TX 0108004dfc05f468200038
+RX 0000000900000009000000020000000000e269c266441bec
+RX 014dfc05f468200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6644504f
+RX 040e3c014dfc005545555100000000020000000800000000000000080000002c6920006c6920002c6920002c69200000000000000000006c6920006c682000
+TX 0108004dfc056c69200038
+RX 000000090000000900000002
+RX 0000000000e269c2
+RX 664611cc
+RX 014dfc056c69200038
+RX 0000003f
+RX 0000003f0000000300000000
+RX 00e269c266464b12
+RX 04
+RX 0e3c014dfc00554555510000000002000000060000000000000006000000a4692000d4692000a4692000a46920000000000000000000d4692000f4682000
+TX 0108004dfc05d469200038
+RX 00000009000000090000000200000000
+RX 00e269c266478916
+RX 01
+RX 4dfc05d469200038
+RX 0000003f0000003f00000003
+RX 0000000000e269c26647be39
+RX 040e3c014dfc00554555510000000002000000010000000000000001000000100d2000180d2000100d2000100d200000000000000000000c6a20006c692000
+TX 0108004dfc050c6a200038
+RX 000000090000000900000002
+RX 0000000000e269c2664987ae
+RX 014dfc050c6a200038
+RX 0000003f0000003f
+RX 000000030000000000e269c2
+RX 6649bc49
+RX 040e3c014dfc00554555510000000002000000010000000000000001000000180d2000200d2000180d2000180d20000000000000000000446a2000d4692000
+TX 0108004dfc05446a200038
+RX 000000090000000900000002
+RX 0000000000e269c2664af918
+RX 014dfc05446a200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 664b2d9b
+RX 040e3c014dfc005545555100000000020000002000000000000000200000007c6a20007c6b20007c6a20007c6a20000000000000000000903320000c6a2000
+TX 0108004dfc059033200038
+RX 0000000900000009000000020000000000e269c2664cf025
+RX 014dfc059033200038
+RX 0000003f0000003f
+RX 000000030000000000e269c2
+RX 664d236e
+RX 040e3c014dfc005545555100000000020000000c000000000000000c0000009c732100fc732100ac732100ac7321000000000000000000705b2000446a2000
+TX 0108004dfc05705b200038
+RX 0000000900000009000000020000000000e269c2
+RX 664ee493
+RX 014dfc05705b200038
+RX 0000003f0000003f0000000300000000
+RX 00e269c2664f184e
+RX 04
+RX 0e3c014dfc00554555510000000001000000080000000000000008000000fc7321001c74210010742100107421000000000000000000c833200090332000
+TX 0108004dfc05c833200038
+RX 000000090000000900000002
+RX 0000000000e269c2665059ac
+RX 014dfc05c833200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6650912f
+RX 040e3c014dfc005545555100000000020000001300000000000000130000001c742100b47421001c7421001c7421000000000000000000b4512000705b2000
+TX 0108004dfc05b451200038
+RX 0000000900000009
+RX 000000020000000000e269c266525485
+RX 014dfc05b451200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6652883b
+RX 040e3c014dfc00554555510000000002000000060000000000000006000000b4742100e4742100b4742100b4742100000000000000000094ad2000c8332000
+TX 0108004dfc0594ad200038
+RX 000000090000000900000002
+RX 0000000000e269c26653c77b
+RX 014dfc0594ad200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6653fcfb
+RX 040e3c014dfc00554555510000000001000000080000000000000008000000ccad2000ecad2000ccad2000ccad20000000000000000000ecad2000b4512000
+TX 0108004dfc05ecad200038
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 6655bd0f
+RX 014dfc05ecad200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6655f6b7
+RX 040e3c014dfc0055455551000000000100000010000000000000001000000024ae200064ae200024ae200024ae200000000000000000009065200094ad2000
+Socket closed

tests/traces/adbcore/hci_0x1001.trace

@@ -0,0 +1,36 @@
+# sendhcicmd 0x1001
+TX 010300011000
+RX 00000004
+RX 00000004
+RX 00000002
+RX 00000000
+RX 00e269bf
+RX 571013e3
+RX 01
+RX 011000
+RX 0000000f0000000f
+RX 00000003
+RX 00000000
+RX 00e269bf
+RX 57105c83
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+RX 000000030000000300000003
+RX 0000000000e269bf571262bd
+RX 07
+RX f001
+TX 010300011000
+RX 000000040000000400000002
+RX 00000000
+RX 00e269bf
+RX 573133d5
+RX 01
+RX 011000
+RX 0000000f
+RX 0000000f
+RX 0000000300000000
+RX 00e269bf57317b7a
+RX 04
+RX 0e0c01011000075301070f000961
+Socket closed

tests/traces/adbcore/hci_0x1337.trace

@@ -0,0 +1,33 @@
+# sendhcicmd 0x1337
+TX 010300011000
+RX 00000004
+RX 00000004
+RX 00000002
+RX 00000000
+RX 00e269bf
+RX 5a00c7f5
+RX 01
+RX 011000
+RX 0000000f
+RX 0000000f0000000300000000
+RX 00e269bf
+RX 5a011119
+RX 040e0c01011000075301070f000961
+TX 070200f001
+RX 000000030000000300000003
+RX 0000000000e269bf5a030c96
+RX 07f001
+TX 010300371300
+RX 000000040000000400000002
+RX 00000000
+RX 00e269bf
+RX 5a7baf54
+RX 01
+RX 371300
+RX 0000000700000007
+RX 00000003
+RX 00000000
+RX 00e269bf
+RX 5a7bf8b7
+RX 040e0401371301
+Socket closed

tests/traces/adbcore/hexdump_0.trace

@@ -0,0 +1,34 @@
+# hexdump 0
+TX 010300011000
+RX 0000000400000004000000020000000000e269bf52d3099e
+RX 01011000
+RX 0000000f0000000f000000030000000000e269bf52d351f1
+RX 040e0c01011000075301070f000961
+TX 070200f001
+RX 00000003000000030000000300000000
+RX 00e269bf52d43cea
+RX 07f001
+TX 0108004dfc0500000000fb
+RX 000000090000000900000002
+RX 00000000
+RX 00e269bf
+RX 530f0c74
+RX 01
+RX 4dfc0500000000fb
+RX 00000102
+RX 00000102
+RX 00000003
+RX 00000000
+RX 00e269bf
+RX 530f5400
+RX 04
+RX 0eff014dfc0000042000010200009f7506006775060067750600677506006775060000000000000000000000000000000000c5880600a175060000000000c588060095750600b1750600d5750600d5750600d5750600d5750600d5750600d5750600d5750600d5750600d5750600c3750600e7750600e7750600e7750600e7750600f9750600077606001576060023760600317606003f7606008576060093760600a5760600677506004d760600a3750600a3750600a3750600cb7606006775060067750600d9760600e7760600f57606000377060067750600677506006775060067750600357706002777060067750600677506005177060043770600117706
+TX 0108004dfc05fb00000005
+RX 000000090000000900000002
+RX 0000000000e269bf5310814f
+RX 014dfc05fb00000005
+RX 0000000c0000000c
+RX 000000030000000000e269bf
+RX 5310b34e
+RX 040e09014dfc000067750600
+Socket closed

tests/traces/adbcore/info_connections.trace

@@ -0,0 +1,187 @@
+#info connections
+TX 010300011000
+RX 0000000400000004000000020000000000e269c211af9287
+RX 01011000
+RX 0000000f0000000f000000030000000000e269c211afc606
+RX 040e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc05e8382000fb
+RX 000000030000000300000003
+RX 0000000000e269c211b12cec
+RX 07f001
+RX 00000009000000090000000200000000
+RX 00e269c211b19677
+RX 01
+RX 4dfc05e8382000fb
+RX 0000010200000102
+RX 000000030000000000e269c2
+RX 11b1ce0d
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05e339200051
+RX 0000000900000009000000020000000000e269c211b36d33
+RX 01
+RX 4dfc05e339200051
+RX 0000005800000058
+RX 000000030000000000e269c2
+RX 11b39be7
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05343a2000fb
+RX 000000090000000900000002
+RX 0000000000e269c211b5679f
+RX 014dfc05343a2000fb
+RX 000001020000010200000003
+RX 0000000000e269c211b59bbc
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc052f3b200051
+RX 000000090000000900000002
+RX 0000000000e269c211b6da65
+RX 014dfc052f3b200051
+RX 00000058
+RX 000000580000000300000000
+RX 00e269c211b7103c
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05803b2000fb
+RX 00000009000000090000000200000000
+RX 00e269c211b8d0df
+RX 01
+RX 4dfc05803b2000fb
+RX 000001020000010200000003
+RX 0000000000e269c211b90a7f
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc057b3c200051
+RX 0000000900000009000000020000000000e269c211ba4851
+RX 01
+RX 4dfc057b3c200051
+RX 0000005800000058
+RX 000000030000000000e269c2
+RX 11ba776c
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05cc3c2000fb
+RX 000000090000000900000002
+RX 0000000000e269c211bc4807
+RX 014dfc05cc3c2000fb
+RX 0000010200000102
+RX 000000030000000000e269c211bc7e24
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05c73d200051
+RX 0000000900000009000000020000000000e269c211bdb8a1
+RX 014dfc05c73d200051
+RX 0000005800000058
+RX 000000030000000000e269c2
+RX 11bded98
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05183e2000fb
+RX 0000000900000009000000020000000000e269c211bfb647
+RX 01
+RX 4dfc05183e2000fb
+RX 0000010200000102
+RX 000000030000000000e269c2
+RX 11bfe6b2
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05133f200051
+RX 0000000900000009000000020000000000e269c211c1aa86
+RX 014dfc05133f200051
+RX 00000058
+RX 00000058000000030000000000e269c2
+RX 11c1da6e
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05643f2000fb
+RX 0000000900000009000000020000000000e269c2
+RX 11c31d18
+RX 014dfc05643f2000fb
+RX 00000102000001020000000300000000
+RX 00e269c211c35297
+RX 04
+RX 0eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc055f40200051
+RX 000000090000000900000002
+RX 0000000000e269c211c51823
+RX 014dfc055f40200051
+RX 00000058
+RX 000000580000000300000000
+RX 00e269c211c54c9e
+RX 04
+RX 0e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05b0402000fb
+RX 000000090000000900000002
+RX 0000000000e269c211c689b0
+RX 014dfc05b0402000fb
+RX 00000102
+RX 000001020000000300000000
+RX 00e269c211c6bf30
+RX 04
+RX 0eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05ab41200051
+RX 000000090000000900000002
+RX 0000000000e269c2
+RX 11c88437
+RX 014dfc05ab41200051
+RX 00000058
+RX 000000580000000300000000
+RX 00e269c211c8ba69
+RX 04
+RX 0e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05fc412000fb
+RX 000000090000000900000002
+RX 0000000000e269c211c9f7a0
+RX 014dfc05fc412000fb
+RX 00000102
+RX 00000102000000030000000000e269c2
+RX 11ca2c9d
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05f742200051
+RX 000000090000000900000002
+RX 0000000000e269c211cbee6a
+RX 014dfc05f742200051
+RX 00000058
+RX 00000058000000030000000000e269c2
+RX 11cc2779
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc0548432000fb
+RX 0000000900000009000000020000000000e269c2
+RX 11cde3be
+RX 014dfc0548432000fb
+RX 00000102
+RX 000001020000000300000000
+RX 00e269c211ce175c
+RX 04
+RX 0eff014dfc000900000000000000000000000000000000000000000000000000777700c91000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000007d0000007d00000c001eff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002800000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000000100000000000000f0ff0000000000000000000001c4000000000000
+TX 0108004dfc054344200051
+RX 0000000900000009000000020000000000e269c2
+RX 11cf5a52
+RX 014dfc054344200051
+RX 000000580000005800000003
+RX 0000000000e269c211cf8917
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc0594442000fb
+RX 0000000900000009000000020000000000e269c211d14fcf
+RX 01
+RX 4dfc0594442000fb
+RX 0000010200000102
+RX 000000030000000000e269c211d182db
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc058f45200051
+RX 0000000900000009000000020000000000e269c2
+RX 11d2c911
+RX 014dfc058f45200051
+RX 00000058000000580000000300000000
+RX 00e269c211d2f819
+RX 04
+RX 0e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05e0452000fb
+RX 0000000900000009
+RX 000000020000000000e269c211d4c00a
+RX 014dfc05e0452000fb
+RX 00000102
+RX 00000102000000030000000000e269c2
+RX 11d4fa18
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05db46200051
+RX 0000000900000009
+RX 000000020000000000e269c211d6b5d7
+RX 014dfc05db46200051
+RX 00000058
+RX 00000058000000030000000000e269c2
+RX 11d6efa7
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+Socket closed

tests/traces/adbcore/info_connections_2.trace

@@ -0,0 +1,168 @@
+# info connections
+TX 010300011000
+RX 0000000400000004000000020000000000e26b46e2c309cc
+RX 01011000
+RX 0000000f0000000f000000030000000000e26b46e2c3274f
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc05e8382000fb
+RX 000000030000000300000003
+RX 0000000000e26b46e2c428e8
+RX 07
+RX f001
+RX 0000000900000009000000020000000000e26b46
+RX e2c446b6
+RX 014dfc05e8382000fb
+RX 00000102000001020000000300000000
+RX 00e26b46e2c46686
+RX 04
+RX 0eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05e339200051
+RX 0000000900000009000000020000000000e26b46e2c54298
+RX 01
+RX 4dfc05e339200051
+RX 0000005800000058
+RX 000000030000000000e26b46e2c55b0a
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05343a2000fb
+RX 0000000900000009000000020000000000e26b46e2c66e34
+RX 014dfc05343a2000fb
+RX 000001020000010200000003
+RX 0000000000e26b46e2c68443
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc052f3b200051
+RX 000000090000000900000002
+RX 0000000000e26b46e2c790ea
+RX 014dfc052f3b200051
+RX 00000058000000580000000300000000
+RX 00e26b46e2c7af14
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05803b2000fb
+RX 000000090000000900000002
+RX 0000000000e26b46e2c8a5a1
+RX 014dfc05803b2000fb
+RX 00000102000001020000000300000000
+RX 00e26b46e2c8c6f1
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc057b3c200051
+RX 0000000900000009000000020000000000e26b46e2c987eb
+RX 014dfc057b3c200051
+RX 0000005800000058000000030000000000e26b46
+RX e2c9a0dd
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05cc3c2000fb
+RX 000000090000000900000002
+RX 0000000000e26b46e2caa510
+RX 014dfc05cc3c2000fb
+RX 0000010200000102000000030000000000e26b46
+RX e2cac525
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05c73d200051
+RX 0000000900000009000000020000000000e26b46e2cbcf4b
+RX 01
+RX 4dfc05c73d200051
+RX 000000580000005800000003
+RX 0000000000e26b46e2cbf034
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05183e2000fb
+RX 0000000900000009000000020000000000e26b46e2cca023
+RX 014dfc05183e2000fb
+RX 000001020000010200000003
+RX 0000000000e26b46e2ccc67f
+RX 04
+RX 0eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05133f200051
+RX 00000009000000090000000200000000
+RX 00e26b46e2cda8a4
+RX 01
+RX 4dfc05133f200051
+RX 0000005800000058000000030000000000e26b46e2cdce30
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05643f2000fb
+RX 0000000900000009000000020000000000e26b46
+RX e2ced9d5
+RX 014dfc05643f2000fb
+RX 000001020000010200000003
+RX 0000000000e26b46e2cef558
+RX 04
+RX 0eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc055f40200051
+RX 000000090000000900000002
+RX 0000000000e26b46e2cf504b
+RX 014dfc055f40200051
+RX 00000058000000580000000300000000
+RX 00e26b46e2cf73b7
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05b0402000fb
+RX 000000090000000900000002
+RX 0000000000e26b46e2d06c12
+RX 014dfc05b0402000fb
+RX 0000010200000102000000030000000000e26b46
+RX e2d093f7
+RX 040eff014dfc0007000000000000000000000000000007000000000000000000007711572d980700000000000010002e1a3a022300feb10a00c821ffff8ffa9bff59870100000000000000000000000000000000000000000000000000008d0500fa0a401f0000401f00000c001adddbea2d9c47bc1aa6afe664ff31591aa6e98a5eaaff39ecb5ce4447590dfb73a4161203cd6e77be6a4bcfb3ee52d3e2c40000000028000404000000130000001000000000020001003c002003001800009c7e1200b00402000200000002000101010200000000000000000000ffffffffffffffff0000000100000000000005f8ff001add0020000000000015d1000000000000
+TX 0108004dfc05ab41200051
+RX 000000090000000900000002
+RX 0000000000e26b46e2d18faa
+RX 014dfc05ab41200051
+RX 0000005800000058000000030000000000e26b46e2d1ade2
+RX 040e55014dfc000000000000000000000000000000000000a4000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000001000000
+TX 0108004dfc05fc412000fb
+RX 0000000900000009000000020000000000e26b46e2d2b2dd
+RX 014dfc05fc412000fb
+RX 0000010200000102000000030000000000e26b46e2d2ceb2
+RX 040eff014dfc000800000000000000000000000000000000000000000000000000777700c91000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000007d0000007d00000b001eff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002800000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000000100000000000000f0ff0000000000000000000001c4000000000000
+TX 0108004dfc05f742200051
+RX 0000000900000009000000020000000000e26b46e2d3c699
+RX 01
+RX 4dfc05f742200051
+RX 00000058000000580000000300000000
+RX 00e26b46e2d3e510
+RX 04
+RX 0e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc0548432000fb
+RX 0000000900000009000000020000000000e26b46e2d563ce
+RX 014dfc0548432000fb
+RX 00000102000001020000000300000000
+RX 00e26b46e2d57e0a
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc054344200051
+RX 0000000900000009000000020000000000e26b46e2d62821
+RX 014dfc054344200051
+RX 000000580000005800000003
+RX 0000000000e26b46e2d63ad6
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc0594442000fb
+RX 0000000900000009
+RX 000000020000000000e26b46
+RX e2d6c43c
+RX 014dfc0594442000fb
+RX 00000102000001020000000300000000
+RX 00e26b46e2d6ebde
+RX 04
+RX 0eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc058f45200051
+RX 0000000900000009000000020000000000e26b46e2d7daf3
+RX 01
+RX 4dfc058f45200051
+RX 00000058000000580000000300000000
+RX 00e26b46e2d7fab5
+RX 04
+RX 0e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05e0452000fb
+RX 0000000900000009
+RX 000000020000000000e26b46
+RX e2d8ed9a
+RX 014dfc05e0452000fb
+RX 00000102000001020000000300000000
+RX 00e26b46e2d91d63
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05db46200051
+RX 0000000900000009
+RX 000000020000000000e26b46
+RX e2da0321
+RX 014dfc05db46200051
+RX 0000005800000058000000030000000000e26b46e2da2145
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+RX 0000001a
+Socket closed

tests/traces/adbcore/info_device.trace

@@ -0,0 +1,44 @@
+#info device
+TX 010300011000
+RX 00000004
+RX 00000004
+RX 00000002
+RX 00000000
+RX 00e269c2
+RX 1010a0f2
+RX 01
+RX 011000
+RX 0000000f
+RX 0000000f
+RX 00000003
+RX 00000000
+RX 00e269c2
+RX 1010e99d
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc052c0c210006
+RX 0000000300000003000000030000000000e269c210128aa7
+RX 07f001
+RX 000000090000000900000002
+RX 0000000000e269c210129ad2
+RX 014dfc052c0c210006
+RX 0000000d
+RX 0000000d000000030000000000e269c2
+RX 1012a345
+RX 040e0a014dfc00f1037dc795f8
+TX 0108004dfc05b4782100fb
+RX 0000000900000009000000020000000000e269c210130715
+RX 014dfc05b4782100fb
+RX 0000010200000102000000030000000000e269c2
+RX 10130fc0
+RX 04
+RX 0eff014dfc0008094e657875732035170305110a110c110e111211151116111f112f1100123211010501070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000107a21000e0a014dfc00f1
+TX 0108004dfc05af79210007
+RX 0000000900000009000000020000000000e269c210138340
+RX 01
+RX 4dfc05af79210007
+RX 0000000e0000000e00000003
+RX 0000000000e269c210138aa9
+RX 040e0b014dfc00037dc795f80461
+Socket closed

tests/traces/adbcore/info_heap.trace

@@ -0,0 +1,685 @@
+# info heap
+TX 010300011000
+RX 0000000400000004000000020000000000e269c200a6dc56
+RX 01011000
+RX 0000000f0000000f000000030000000000e269c2
+RX 00a717ec
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc059430200004
+RX 000000030000000300000003
+RX 0000000000e269c200a87965
+RX 07f001
+RX 00000009000000090000000200000000
+RX 00e269c200a8e193
+RX 01
+RX 4dfc059430200004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00a918e2
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05c85d200030
+RX 000000090000000900000002
+RX 0000000000e269c200aab793
+RX 014dfc05c85d200030
+RX 00000037
+RX 000000370000000300000000
+RX 00e269c200aaf0ec
+RX 04
+RX 0e34014dfc00434f4c42000000000700000008000000a4792100a479210020010000200000000000000000000000f85d200068ec2000
+TX 0108004dfc05a479210004
+RX 000000090000000900000002
+RX 0000000000e269c200acb1ba
+RX 014dfc05a479210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200ace5c2
+RX 04
+RX 0e08014dfc00c85d2000
+TX 0108004dfc05c879210004
+RX 000000090000000900000002
+RX 0000000000e269c200ae2501
+RX 014dfc05c879210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200ae5915
+RX 04
+RX 0e08014dfc00587a2100
+TX 0108004dfc05ec79210004
+RX 0000000900000009000000020000000000e269c200b01eae
+RX 01
+RX 4dfc05ec79210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200b04d6c
+RX 04
+RX 0e08014dfc007c7a2100
+TX 0108004dfc05107a210004
+RX 0000000900000009000000020000000000e269c200b19061
+RX 014dfc05107a210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200b1c4f3
+RX 04
+RX 0e08014dfc00c8792100
+TX 0108004dfc05347a210004
+RX 0000000900000009000000020000000000e269c200b38d00
+RX 01
+RX 4dfc05347a210004
+RX 0000000b0000000b
+RX 000000030000000000e269c200b3bbaa
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05587a210004
+RX 0000000900000009000000020000000000e269c200b58252
+RX 014dfc05587a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00b5b18b
+RX 040e08014dfc00ec792100
+TX 0108004dfc057c7a210004
+RX 0000000900000009000000020000000000e269c200b6f455
+RX 014dfc057c7a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00b728c4
+RX 040e08014dfc00a07a2100
+TX 0108004dfc05a07a210004
+RX 000000090000000900000002
+RX 0000000000e269c200b8f1d6
+RX 014dfc05a07a210004
+RX 0000000b0000000b000000030000000000e269c2
+RX 00b92612
+RX 040e08014dfc0000000000
+TX 0108004dfc05f85d200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00ba65be
+RX 014dfc05f85d200030
+RX 00000037000000370000000300000000
+RX 00e269c200ba9b76
+RX 04
+RX 0e34014dfc00434f4c42000000000700000008000000087b2100c47a210020020000400000000000000000000000285e2000c85d2000
+TX 0108004dfc05c47a210004
+RX 000000090000000900000002
+RX 0000000000e269c200bc6390
+RX 014dfc05c47a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00bc987e
+RX 04
+RX 0e08014dfc00087b2100
+TX 0108004dfc05087b210004
+RX 0000000900000009000000020000000000e269c2
+RX 00bdd708
+RX 014dfc05087b210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200be075f
+RX 04
+RX 0e08014dfc004c7b2100
+TX 0108004dfc054c7b210004
+RX 0000000900000009000000020000000000e269c200bfd07f
+RX 014dfc054c7b210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00bfffe2
+RX 040e08014dfc00907b2100
+TX 0108004dfc05907b210004
+RX 000000090000000900000002
+RX 0000000000e269c200c1c264
+RX 014dfc05907b210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00c1fba1
+RX 040e08014dfc00d47b2100
+TX 0108004dfc05d47b210004
+RX 000000090000000900000002
+RX 0000000000e269c200c339f3
+RX 014dfc05d47b210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00c36f64
+RX 040e08014dfc00187c2100
+TX 0108004dfc05187c210004
+RX 0000000900000009000000020000000000e269c200c53386
+RX 014dfc05187c210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00c56249
+RX 040e08014dfc005c7c2100
+TX 0108004dfc055c7c210004
+RX 0000000900000009000000020000000000e269c2
+RX 00c6a64c
+RX 014dfc055c7c210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200c6d51e
+RX 04
+RX 0e08014dfc00a07c2100
+TX 0108004dfc05a07c210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00c8a176
+RX 014dfc05a07c210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200c8daef
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc05285e200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00ca1661
+RX 014dfc05285e200030
+RX 000000370000003700000003
+RX 0000000000e269c200ca4c0b
+RX 040e34014dfc00434f4c42000000000a0000000a000000e47c2100e47c2100780a0000080100000000000000000000885e2000f85d2000
+TX 0108004dfc05e47c210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00cc13aa
+RX 014dfc05e47c210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200cc49c8
+RX 04
+RX 0e08014dfc00f07d2100
+TX 0108004dfc05f07d210004
+RX 00000009000000090000000200000000
+RX 00e269c200ce084a
+RX 014dfc05f07d210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00ce3d02
+RX 040e08014dfc00fc7e2100
+TX 0108004dfc05fc7e210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00cf7abc
+RX 014dfc05fc7e210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200cfafff
+RX 04
+RX 0e08014dfc0008802100
+TX 0108004dfc050880210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00d1718e
+RX 014dfc050880210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200d1ad02
+RX 040e08014dfc0014812100
+TX 0108004dfc051481210004
+RX 0000000900000009000000020000000000e269c200d2e49d
+RX 01
+RX 4dfc051481210004
+RX 0000000b0000000b
+RX 000000030000000000e269c200d313fc
+RX 040e08014dfc0020822100
+TX 0108004dfc052082210004
+RX 0000000900000009000000020000000000e269c2
+RX 00d4dfc6
+RX 014dfc052082210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200d50e59
+RX 040e08014dfc002c832100
+TX 0108004dfc052c83210004
+RX 00000009000000090000000200000000
+RX 00e269c200d65308
+RX 01
+RX 4dfc052c83210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00d68806
+RX 040e08014dfc0038842100
+TX 0108004dfc053884210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00d84aba
+RX 014dfc053884210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200d88584
+RX 040e08014dfc0044852100
+TX 0108004dfc054485210004
+RX 0000000900000009000000020000000000e269c2
+RX 00da42d6
+RX 014dfc054485210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200da7651
+RX 040e08014dfc0050862100
+TX 0108004dfc055086210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00dbba9e
+RX 014dfc055086210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200dbf538
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc05885e200030
+RX 00000009000000090000000200000000
+RX 00e269c200ddb037
+RX 01
+RX 4dfc05885e200030
+RX 000000370000003700000003
+RX 0000000000e269c200dde9b6
+RX 040e34014dfc00434f4c4200000000040000000400000024c6210024c62100b0100000280400000000000000000000585e2000285e2000
+TX 0108004dfc0524c6210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00df268a
+RX 014dfc0524c6210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200df5cd7
+RX 040e08014dfc0050ca2100
+TX 0108004dfc0550ca210004
+RX 0000000900000009000000020000000000e269c2
+RX 00e11eb6
+RX 01
+RX 4dfc0550ca210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200e15819
+RX 040e08014dfc007cce2100
+TX 0108004dfc057cce210004
+RX 00000009000000090000000200000000
+RX 00e269c200e29334
+RX 01
+RX 4dfc057cce210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00e2c73e
+RX 040e08014dfc00a8d22100
+TX 0108004dfc05a8d2210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00e4925e
+RX 014dfc05a8d2210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200e4c673
+RX 040e08014dfc0000000000
+TX 0108004dfc05585e200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00e5ff65
+RX 014dfc05585e200030
+RX 000000370000003700000003
+RX 0000000000e269c200e63326
+RX 040e34014dfc00434f4c42000000001000000010000000d4d62100d4d621008044000044040000000000000000000038ec2000885e2000
+TX 0108004dfc05d4d6210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00e7fcce
+RX 014dfc05d4d6210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200e8313f
+RX 040e08014dfc001cdb2100
+TX 0108004dfc051cdb210004
+RX 0000000900000009000000020000000000e269c200e9f3c0
+RX 014dfc051cdb210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00ea223f
+RX 040e08014dfc0064df2100
+TX 0108004dfc0564df210004
+RX 00000009000000090000000200000000
+RX 00e269c200eb6947
+RX 01
+RX 4dfc0564df210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200eb9dc8
+RX 04
+RX 0e08014dfc00ace32100
+TX 0108004dfc05ace3210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00ed6025
+RX 014dfc05ace3210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00edb820
+RX 040e08014dfc00f4e72100
+TX 0108004dfc05f4e7210004
+RX 00000009000000090000000200000000
+RX 00e269c200eeaa84
+RX 014dfc05f4e7210004
+RX 0000000b0000000b000000030000000000e269c200eeb23c
+RX 04
+RX 0e08014dfc003cec2100
+TX 0108004dfc053cec210004
+RX 0000000900000009
+RX 000000020000000000e269c200ef25f0
+RX 01
+RX 4dfc053cec210004
+RX 0000000b
+RX 0000000b000000030000000000e269c200ef2e26
+RX 04
+RX 0e08014dfc0084f02100
+TX 0108004dfc0584f0210004
+RX 0000000900000009000000020000000000e269c200efa285
+RX 014dfc0584f0210004
+RX 0000000b
+RX 0000000b000000030000000000e269c200efa979
+RX 040e08014dfc00ccf42100
+TX 0108004dfc05ccf4210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00f0207c
+RX 014dfc05ccf4210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200f028c8
+RX 04
+RX 0e08014dfc0014f92100
+TX 0108004dfc0514f9210004
+RX 0000000900000009000000020000000000e269c200f0b8fd
+RX 014dfc0514f9210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200f0bf4a
+RX 040e08014dfc005cfd2100
+TX 0108004dfc055cfd210004
+RX 00000009000000090000000200000000
+RX 00e269c200f11c7d
+RX 01
+RX 4dfc055cfd210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200f12aa4
+RX 040e08014dfc00a4012200
+TX 0108004dfc05a401220004
+RX 0000000900000009000000020000000000e269c200f1946c
+RX 014dfc05a401220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200f19f40
+RX 040e08014dfc00ec052200
+TX 0108004dfc05ec05220004
+RX 0000000900000009000000020000000000e269c200f20f44
+RX 01
+RX 4dfc05ec05220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200f21b6a
+RX 04
+RX 0e08014dfc00340a2200
+TX 0108004dfc05340a220004
+RX 0000000900000009000000020000000000e269c200f29be7
+RX 014dfc05340a220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00f2b3bd
+RX 040e08014dfc007c0e2200
+TX 0108004dfc057c0e220004
+RX 00000009
+RX 00000009
+RX 0000000200000000
+RX 00e269c200f3a7c6
+RX 01
+RX 4dfc057c0e220004
+RX 0000000b0000000b000000030000000000e269c2
+RX 00f4951f
+RX 040e08014dfc00c4122200
+TX 0108004dfc05c412220004
+RX 0000000900000009
+RX 000000020000000000e269c200f637e5
+RX 014dfc05c412220004
+RX 0000000b0000000b000000030000000000e269c200f63f91
+RX 040e08014dfc000c172200
+TX 0108004dfc050c17220004
+RX 00000009
+RX 000000090000000200000000
+RX 00e269c200f6f156
+RX 014dfc050c17220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200f6f966
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc0538ec200030
+RX 00000009000000090000000200000000
+RX 00e269c200f76de0
+RX 014dfc0538ec200030
+RX 0000003700000037000000030000000000e269c200f7757d
+RX 040e34014dfc00434f4c42000000000f0000000f000000541b2200541b22009402000028000000000000000000000068ec2000585e2000
+TX 0108004dfc05541b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00f8133d
+RX 014dfc05541b220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200f83a20
+RX 04
+RX 0e08014dfc00801b2200
+TX 0108004dfc05801b220004
+RX 0000000900000009000000020000000000e269c200f909ee
+RX 014dfc05801b220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200f935e2
+RX 04
+RX 0e08014dfc00ac1b2200
+TX 0108004dfc05ac1b220004
+RX 0000000900000009000000020000000000e269c2
+RX 00fb146c
+RX 014dfc05ac1b220004
+RX 0000000b
+RX 0000000b00000003
+RX 0000000000e269c200fb4327
+RX 040e08014dfc00d81b2200
+TX 0108004dfc05d81b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00fd0682
+RX 014dfc05d81b220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200fd3fca
+RX 04
+RX 0e08014dfc00041c2200
+TX 0108004dfc05041c220004
+RX 00000009000000090000000200000000
+RX 00e269c200fe7d8e
+RX 01
+RX 4dfc05041c220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200feb0d4
+RX 040e08014dfc00301c2200
+TX 0108004dfc05301c220004
+RX 0000000900000009000000020000000000e269c2
+RX 010074cc
+RX 014dfc05301c220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c20100a76b
+RX 04
+RX 0e08014dfc005c1c2200
+TX 0108004dfc055c1c220004
+RX 0000000900000009000000020000000000e269c20101eacb
+RX 014dfc055c1c220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201021779
+RX 04
+RX 0e08014dfc00881c2200
+TX 0108004dfc05881c220004
+RX 0000000900000009000000020000000000e269c20103e6c3
+RX 014dfc05881c220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201041515
+RX 04
+RX 0e08014dfc00b41c2200
+TX 0108004dfc05b41c220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 01055aa2
+RX 014dfc05b41c220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201058f0e
+RX 040e08014dfc00e01c2200
+TX 0108004dfc05e01c220004
+RX 000000090000000900000002
+RX 0000000000e269c201075199
+RX 014dfc05e01c220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201078a8c
+RX 04
+RX 0e08014dfc000c1d2200
+TX 0108004dfc050c1d220004
+RX 0000000900000009000000020000000000e269c2
+RX 010948a2
+RX 014dfc050c1d220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201097c0d
+RX 04
+RX 0e08014dfc00381d2200
+TX 0108004dfc05381d220004
+RX 0000000900000009
+RX 000000020000000000e269c2010ac2b3
+RX 014dfc05381d220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2010afeef
+RX 04
+RX 0e08014dfc00641d2200
+TX 0108004dfc05641d220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 010cbc41
+RX 014dfc05641d220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2010cefe5
+RX 040e08014dfc00901d2200
+TX 0108004dfc05901d220004
+RX 00000009000000090000000200000000
+RX 00e269c2010e2df1
+RX 01
+RX 4dfc05901d220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2010e61ea
+RX 040e08014dfc00bc1d2200
+TX 0108004dfc05bc1d220004
+RX 000000090000000900000002
+RX 0000000000e269c20110231e
+RX 014dfc05bc1d220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201105c92
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc0568ec200030
+RX 0000000900000009000000020000000000e269c2
+RX 01119816
+RX 014dfc0568ec200030
+RX 00000037000000370000000300000000
+RX 00e269c20111c667
+RX 04
+RX 0e34014dfc00434f4c42000000000f0000000f000000e81d2200e81d22001c020000200000000000000000000000c85d200038ec2000
+TX 0108004dfc05e81d220004
+RX 00000009000000090000000200000000
+RX 00e269c201138f25
+RX 01
+RX 4dfc05e81d220004
+RX 0000000b0000000b
+RX 000000030000000000e269c20113c768
+RX 040e08014dfc000c1e2200
+TX 0108004dfc050c1e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 011507e7
+RX 014dfc050c1e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201153d26
+RX 04
+RX 0e08014dfc00301e2200
+TX 0108004dfc05301e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 0116fe0e
+RX 014dfc05301e220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201173734
+RX 04
+RX 0e08014dfc00541e2200
+TX 0108004dfc05541e220004
+RX 0000000900000009000000020000000000e269c20118f296
+RX 014dfc05541e220004
+RX 0000000b0000000b
+RX 000000030000000000e269c2011926ef
+RX 040e08014dfc00781e2200
+TX 0108004dfc05781e220004
+RX 0000000900000009000000020000000000e269c2011a6bbe
+RX 014dfc05781e220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2011a9958
+RX 04
+RX 0e08014dfc009c1e2200
+TX 0108004dfc059c1e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 011c676b
+RX 014dfc059c1e220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2011c9b6e
+RX 040e08014dfc00c01e2200
+TX 0108004dfc05c01e220004
+RX 0000000900000009000000020000000000e269c2
+RX 011dda94
+RX 014dfc05c01e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c2011e0829
+RX 04
+RX 0e08014dfc00e41e2200
+TX 0108004dfc05e41e220004
+RX 0000000900000009000000020000000000e269c2011fd393
+RX 014dfc05e41e220004
+RX 0000000b0000000b
+RX 0000000300000000
+RX 00e269c201200234
+RX 040e08014dfc00081f2200
+TX 0108004dfc05081f220004
+RX 0000000900000009000000020000000000e269c2
+RX 012145f7
+RX 014dfc05081f220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c20121a431
+RX 04
+RX 0e08014dfc002c1f2200
+TX 0108004dfc052c1f220004
+RX 000000090000000900000002
+RX 0000000000e269c201230eec
+RX 014dfc052c1f220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201231658
+RX 040e08014dfc00501f2200
+TX 0108004dfc05501f220004
+RX 0000000900000009
+RX 000000020000000000e269c20124484f
+RX 014dfc05501f220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201244f7a
+RX 040e08014dfc00741f2200
+TX 0108004dfc05741f220004
+RX 00000009
+RX 00000009000000020000000000e269c201250543
+RX 01
+RX 4dfc05741f220004
+RX 0000000b0000000b000000030000000000e269c2
+RX 01250d7b
+RX 040e08014dfc00981f2200
+TX 0108004dfc05981f220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 0125e492
+RX 014dfc05981f220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c201260ab3
+RX 040e08014dfc00bc1f2200
+TX 0108004dfc05bc1f220004
+RX 0000000900000009000000020000000000e269c2
+RX 01276da0
+RX 014dfc05bc1f220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201279c46
+RX 040e08014dfc00e01f2200
+TX 0108004dfc05e01f220004
+RX 0000000900000009000000020000000000e269c2
+RX 0128e461
+RX 014dfc05e01f220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2012914b3
+RX 040e08014dfc0000000000
+Socket closed

tests/traces/adbcore/info_heap_s8.trace.broken

@@ -0,0 +1,747 @@
+# info heap
+TX 01011000
+RX 0000000f0000000f000000030000000000e27beebf93dd9f
+RX 040e0c01011000094f01090f001a41
+TX 014dfc057c06200004
+RX 0000000b0000000b000000030000000000e27beebf9481eb
+RX 040e08014dfc009c062000
+TX 014dfc059c06200030
+RX 0000003700000037000000030000000000e27beebf94e223
+RX 040e34014dfc00bc06200020006000782a2100b82a21005f02047300000000000000005c00b8ebdc06200060003e007836210078362100
+TX 014dfc05782a210004
+RX 0000000b0000000b000000030000000000e27beebf951eb3
+RX 040e08014dfc00f82a2100
+TX 014dfc059c2a210004
+RX 0000000b0000000b000000030000000000e27beebf955ded
+RX 040e08014dfc003f700000
+TX 014dfc05c02a210004
+RX 0000000b0000000b000000030000000000e27beebf95a038
+RX 040e08014dfc000e08014d
+TX 014dfc05e42a210004
+RX 0000000b0000000b000000030000000000e27beebf95ddda
+RX 040e08014dfc00cc118300
+TX 014dfc05082b210004
+RX 0000000b0000000b000000030000000000e27beebf960919
+RX 040e08014dfc00057e2f20
+TX 014dfc052c2b210004
+RX 0000000b0000000b000000030000000000e27beebf961c69
+RX 040e08014dfc0055382000
+TX 014dfc05502b210004
+RX 0000000b0000000b000000030000000000e27beebf964a96
+RX 040e08014dfc00ffff0100
+TX 014dfc05742b210004
+RX 0000000b0000000b000000030000000000e27beebf969a6a
+RX 040e08014dfc0000000000
+TX 014dfc05982b210004
+RX 0000000b0000000b000000030000000000e27beebf96fad6
+RX 040e08014dfc00b82b2100
+TX 014dfc05bc2b210004
+RX 0000000b0000000b000000030000000000e27beebf973df6
+RX 040e08014dfc000000ffff
+TX 014dfc05e02b210004
+RX 0000000b0000000b000000030000000000e27beebf97805e
+RX 040e08014dfc0000000010
+TX 014dfc05042c210004
+RX 0000000b0000000b000000030000000000e27beebf97c6f5
+RX 040e08014dfc00ffff0038
+TX 014dfc05282c210004
+RX 0000000b0000000b000000030000000000e27beebf9805a2
+RX 040e08014dfc00e000004c
+TX 014dfc054c2c210004
+RX 0000000b0000000b000000030000000000e27beebf9847c9
+RX 040e08014dfc0065000000
+TX 014dfc05702c210004
+RX 0000000b0000000b000000030000000000e27beebf98a930
+RX 040e08014dfc006500a800
+TX 014dfc05942c210004
+RX 0000000b0000000b000000030000000000e27beebf99108a
+RX 040e08014dfc00d0010300
+TX 014dfc05b82c210004
+RX 0000000b0000000b000000030000000000e27beebf99524c
+RX 040e08014dfc00d82c2100
+TX 014dfc05dc2c210004
+RX 0000000b0000000b000000030000000000e27beebf99929f
+RX 040e08014dfc0000000000
+TX 014dfc05002d210004
+RX 0000000b0000000b000000030000000000e27beebf99d466
+RX 040e08014dfc0000000000
+TX 014dfc05242d210004
+RX 0000000b0000000b000000030000000000e27beebf9a15bc
+RX 040e08014dfc00ffff80ff
+TX 014dfc05482d210004
+RX 0000000b0000000b000000030000000000e27beebf9a56d4
+RX 040e08014dfc0000000500
+TX 014dfc056c2d210004
+RX 0000000b0000000b000000030000000000e27beebf9a9929
+RX 040e08014dfc0000ec0301
+TX 014dfc05902d210004
+RX 0000000b0000000b000000030000000000e27beebf9adc19
+RX 040e08014dfc0045432000
+TX 014dfc05b42d210004
+RX 0000000b0000000b000000030000000000e27beebf9b4126
+RX 040e08014dfc0000010003
+TX 014dfc05d82d210004
+RX 0000000b0000000b000000030000000000e27beebf9ba307
+RX 040e08014dfc00f82d2100
+TX 014dfc05fc2d210004
+RX 0000000b0000000b000000030000000000e27beebf9be4fe
+RX 040e08014dfc0000ff0000
+TX 014dfc05202e210004
+RX 0000000b0000000b000000030000000000e27beebf9c2a13
+RX 040e08014dfc0000a80360
+TX 014dfc05442e210004
+RX 0000000b0000000b000000030000000000e27beebf9c6c61
+RX 040e08014dfc0014000000
+TX 014dfc05682e210004
+RX 0000000b0000000b000000030000000000e27beebf9cab70
+RX 040e08014dfc002f000000
+TX 014dfc058c2e210004
+RX 0000000b0000000b000000030000000000e27beebf9cebaf
+RX 040e08014dfc005f000000
+TX 014dfc05b02e210004
+RX 0000000b0000000b000000030000000000e27beebf9d6ba8
+RX 040e08014dfc002f000000
+TX 014dfc05d42e210004
+RX 0000000b0000000b000000030000000000e27beebf9dad08
+RX 040e08014dfc002f000000
+TX 014dfc05f82e210004
+RX 0000000b0000000b000000030000000000e27beebf9dee39
+RX 040e08014dfc00182f2100
+TX 014dfc051c2f210004
+RX 0000000b0000000b000000030000000000e27beebf9e3190
+RX 040e08014dfc0022000000
+TX 014dfc05402f210004
+RX 0000000b0000000b000000030000000000e27beebf9e71b0
+RX 040e08014dfc0000000000
+TX 014dfc05642f210004
+RX 0000000b0000000b000000030000000000e27beebf9eb2b9
+RX 040e08014dfc0000000000
+TX 014dfc05882f210004
+RX 0000000b0000000b000000030000000000e27beebf9ef366
+RX 040e08014dfc00002f0000
+TX 014dfc05ac2f210004
+RX 0000000b0000000b000000030000000000e27beebf9f354b
+RX 040e08014dfc00006f0000
+TX 014dfc05d02f210004
+RX 0000000b0000000b000000030000000000e27beebf9f7655
+RX 040e08014dfc00002f0000
+TX 014dfc05f42f210004
+RX 0000000b0000000b000000030000000000e27beebf9fb7ca
+RX 040e08014dfc00002f0000
+TX 014dfc051830210004
+RX 0000000b0000000b000000030000000000e27beebfa01abc
+RX 040e08014dfc0038302100
+TX 014dfc053c30210004
+RX 0000000b0000000b000000030000000000e27beebfa0b97a
+RX 040e08014dfc0000220000
+TX 014dfc056030210004
+RX 0000000b0000000b000000030000000000e27beebfa0fbc8
+RX 040e08014dfc0000000000
+TX 014dfc058430210004
+RX 0000000b0000000b000000030000000000e27beebfa13d4e
+RX 040e08014dfc0000000000
+TX 014dfc05a830210004
+RX 0000000b0000000b000000030000000000e27beebfa17f0c
+RX 040e08014dfc0006000000
+TX 014dfc05cc30210004
+RX 0000000b0000000b000000030000000000e27beebfa1bf98
+RX 040e08014dfc00034100ff
+TX 014dfc05f030210004
+RX 0000000b0000000b000000030000000000e27beebfa2020e
+RX 040e08014dfc00a594a534
+TX 014dfc051431210004
+RX 0000000b0000000b000000030000000000e27beebfa267d2
+RX 040e08014dfc0000ff0080
+TX 014dfc053831210004
+RX 0000000b0000000b000000030000000000e27beebfa2c994
+RX 040e08014dfc0058312100
+TX 014dfc055c31210004
+RX 0000000b0000000b000000030000000000e27beebfa32ad9
+RX 040e08014dfc00ffef3df1
+TX 014dfc058031210004
+RX 0000000b0000000b000000030000000000e27beebfa3cb04
+RX 040e08014dfc00034100ff
+TX 014dfc05a431210004
+RX 0000000b0000000b000000030000000000e27beebfa40c2c
+RX 040e08014dfc002800ac01
+TX 014dfc05c831210004
+RX 0000000b0000000b000000030000000000e27beebfa46da9
+RX 040e08014dfc0028000000
+TX 014dfc05ec31210004
+RX 0000000b0000000b000000030000000000e27beebfa4cc7e
+RX 040e08014dfc0000400000
+TX 014dfc051032210004
+RX 0000000b0000000b000000030000000000e27beebfa52e35
+RX 040e08014dfc0000ffffff
+TX 014dfc053432210004
+RX 0000000b0000000b000000030000000000e27beebfa5ccaa
+RX 040e08014dfc0000000005
+TX 014dfc055832210004
+RX 0000000b0000000b000000030000000000e27beebfa62bf3
+RX 040e08014dfc0078322100
+TX 014dfc057c32210004
+RX 0000000b0000000b000000030000000000e27beebfa6cbdb
+RX 040e08014dfc0000002000
+TX 014dfc05a032210004
+RX 0000000b0000000b000000030000000000e27beebfa70e9e
+RX 040e08014dfc00a3ce1400
+TX 014dfc05c432210004
+RX 0000000b0000000b000000030000000000e27beebfa7529e
+RX 040e08014dfc00eb049005
+TX 014dfc05e832210004
+RX 0000000b0000000b000000030000000000e27beebfa7b27a
+RX 040e08014dfc0045064506
+TX 014dfc050c33210004
+RX 0000000b0000000b000000030000000000e27beebfa7db6c
+RX 040e08014dfc006004a104
+TX 014dfc053033210004
+RX 0000000b0000000b000000030000000000e27beebfa82c47
+RX 040e08014dfc0026052605
+TX 014dfc055433210004
+RX 0000000b0000000b000000030000000000e27beebfa88acc
+RX 040e08014dfc00ffac02ff
+TX 014dfc057833210004
+RX 0000000b0000000b000000030000000000e27beebfa8ce07
+RX 040e08014dfc0098332100
+TX 014dfc059c33210004
+RX 0000000b0000000b000000030000000000e27beebfa912b5
+RX 040e08014dfc00c004ffc4
+TX 014dfc05c033210004
+RX 0000000b0000000b000000030000000000e27beebfa954ce
+RX 040e08014dfc003c323232
+TX 014dfc05e433210004
+RX 0000000b0000000b000000030000000000e27beebfa994a5
+RX 040e08014dfc0010101010
+TX 014dfc050834210004
+RX 0000000b0000000b000000030000000000e27beebfa9d741
+RX 040e08014dfc0077777777
+TX 014dfc052c34210004
+RX 0000000b0000000b000000030000000000e27beebfaa3962
+RX 040e08014dfc006f6f6f0f
+TX 014dfc055034210004
+RX 0000000b0000000b000000030000000000e27beebfaa9ffe
+RX 040e08014dfc0074078c8c
+TX 014dfc057434210004
+RX 0000000b0000000b000000030000000000e27beebfab0517
+RX 040e08014dfc00ff060100
+TX 014dfc059834210004
+RX 0000000b0000000b000000030000000000e27beebfab669f
+RX 040e08014dfc00b8342100
+TX 014dfc05bc34210004
+RX 0000000b0000000b000000030000000000e27beebfabc8a4
+RX 040e08014dfc009f747474
+TX 014dfc05e034210004
+RX 0000000b0000000b000000030000000000e27beebfac29a6
+RX 040e08014dfc009f9f9f9f
+TX 014dfc050435210004
+RX 0000000b0000000b000000030000000000e27beebfac8aea
+RX 040e08014dfc007f7f7f7f
+TX 014dfc052835210004
+RX 0000000b0000000b000000030000000000e27beebfacef98
+RX 040e08014dfc007272727c
+TX 014dfc054c35210004
+RX 0000000b0000000b000000030000000000e27beebfad5616
+RX 040e08014dfc0004eb04eb
+TX 014dfc057035210004
+RX 0000000b0000000b000000030000000000e27beebfadf65e
+RX 040e08014dfc0006450645
+TX 014dfc059435210004
+RX 0000000b0000000b000000030000000000e27beebfae3a18
+RX 040e08014dfc0004600460
+TX 014dfc05b835210004
+RX 0000000b0000000b000000030000000000e27beebfae9e98
+RX 040e08014dfc00d8352100
+TX 014dfc05dc35210004
+RX 0000000b0000000b000000030000000000e27beebfaeff80
+RX 040e08014dfc00ffa802ff
+TX 014dfc050036210004
+RX 0000000b0000000b000000030000000000e27beebfaf61dc
+RX 040e08014dfc0007ffc807
+TX 014dfc052436210004
+RX 0000000b0000000b000000030000000000e27beebfafc1f3
+RX 040e08014dfc00bc04ffc0
+TX 014dfc054836210004
+RX 0000000b0000000b000000030000000000e27beebfb0252b
+RX 040e08014dfc003c3c3c3c
+TX 014dfc056c36210004
+RX 0000000b0000000b000000030000000000e27beebfb0c5cf
+RX 040e08014dfc003c3c3c50
+TX 014dfc059036210004
+RX 0000000b0000000b000000030000000000e27beebfb12794
+RX 040e08014dfc002100b82a
+TX 014dfc05b436210004
+RX 0000000b0000000b000000030000000000e27beebfb187f5
+RX 040e08014dfc0021000000
+TX 014dfc05d836210004
+RX 0000000b0000000b000000030000000000e27beebfb2093d
+RX 040e08014dfc0038372100
+TX 014dfc05fc36210004
+RX 0000000b0000000b000000030000000000e27beebfb26af0
+RX 040e08014dfc00077f0006
+TX 014dfc052037210004
+RX 0000000b0000000b000000030000000000e27beebfb2e7d2
+RX 040e08014dfc0005ca05ca
+TX 014dfc054437210004
+RX 0000000b0000000b000000030000000000e27beebfb35c0b
+RX 040e08014dfc00ff14ff14
+TX 014dfc056837210004
+RX 0000000b0000000b000000030000000000e27beebfb3e988
+RX 040e08014dfc004b5a5a5a
+TX 014dfc058c37210004
+RX 0000000b0000000b000000030000000000e27beebfb45c21
+RX 040e08014dfc0001030105
+TX 014dfc05b037210004
+RX 0000000b0000000b000000030000000000e27beebfb4dbda
+RX 040e08014dfc00646c2000
+TX 014dfc05d437210004
+RX 0000000b0000000b000000030000000000e27beebfb56e46
+RX 040e08014dfc00fdf9f5f1
+TX 014dfc05bc06200030
+RX 0000003700000037000000030000000000e27beebfb5f264
+RX 040e34014dfc00dc06200060003e0078362100783621003e02252100000000000000003d00d187fc0620000c011400b84d2100c44e2100
+TX 014dfc057836210004
+RX 0000000b0000000b000000030000000000e27beebfb6719b
+RX 040e08014dfc00d8362100
+TX 014dfc05dc36210004
+RX 0000000b0000000b000000030000000000e27beebfb6f22a
+RX 040e08014dfc00078c8c8c
+TX 014dfc054037210004
+RX 0000000b0000000b000000030000000000e27beebfb78409
+RX 040e08014dfc00ff14ff14
+TX 014dfc05a437210004
+RX 0000000b0000000b000000030000000000e27beebfb7e7fd
+RX 040e08014dfc0001030105
+TX 014dfc050838210004
+RX 0000000b0000000b000000030000000000e27beebfb8720d
+RX 040e08014dfc0000000000
+TX 014dfc056c38210004
+RX 0000000b0000000b000000030000000000e27beebfb8f49f
+RX 040e08014dfc0010101010
+TX 014dfc05d038210004
+RX 0000000b0000000b000000030000000000e27beebfb970cc
+RX 040e08014dfc000a0602fe
+TX 014dfc053439210004
+RX 0000000b0000000b000000030000000000e27beebfb9fa64
+RX 040e08014dfc0004080c10
+TX 014dfc059839210004
+RX 0000000b0000000b000000030000000000e27beebfba7925
+RX 040e08014dfc0000000003
+TX 014dfc05fc39210004
+RX 0000000b0000000b000000030000000000e27beebfbaf5de
+RX 040e08014dfc00706f7d75
+TX 014dfc05603a210004
+RX 0000000b0000000b000000030000000000e27beebfbb6de7
+RX 04
+RX 0e08014dfc0071718d87
+TX 014dfc05c43a210004
+RX 0000000b0000000b000000030000000000e27beebfbbef45
+RX 040e08014dfc0050615d54
+TX 014dfc05283b210004
+RX 0000000b0000000b000000030000000000e27beebfbc7293
+RX 040e08014dfc0058666d60
+TX 014dfc058c3b210004
+RX 0000000b0000000b000000030000000000e27beebfbcf44e
+RX 040e08014dfc000a07ee03
+TX 014dfc05f03b210004
+RX 0000000b0000000b000000030000000000e27beebfbd79e9
+RX 040e08014dfc007d756d75
+TX 014dfc05543c210004
+RX 0000000b0000000b000000030000000000e27beebfbddc7d
+RX 040e08014dfc008d877c81
+TX 014dfc05b83c210004
+RX 0000000b0000000b000000030000000000e27beebfbea57f
+RX 040e08014dfc005d54575f
+TX 014dfc051c3d210004
+RX 0000000b0000000b000000030000000000e27beebfbf66d7
+RX 040e08014dfc006d605c6c
+TX 014dfc05803d210004
+RX 0000000b0000000b000000030000000000e27beebfbfe3ac
+RX 040e08014dfc000e782220
+TX 014dfc05e43d210004
+RX 0000000b0000000b000000030000000000e27beebfc06663
+RX 040e08014dfc000d0d0d0d
+TX 014dfc05483e210004
+RX 0000000b0000000b000000030000000000e27beebfc0e82a
+RX 040e08014dfc000000000d
+TX 014dfc05ac3e210004
+RX 0000000b0000000b000000030000000000e27beebfc16d41
+RX 040e08014dfc00c4012c53
+TX 014dfc05103f210004
+RX 0000000b0000000b000000030000000000e27beebfc1f727
+RX 040e08014dfc0000005d5d
+TX 014dfc05743f210004
+RX 0000000b0000000b000000030000000000e27beebfc27c7f
+RX 040e08014dfc00c401ec53
+TX 014dfc05d83f210004
+RX 0000000b0000000b000000030000000000e27beebfc303b4
+RX 040e08014dfc0038402100
+TX 014dfc053c40210004
+RX 0000000b0000000b000000030000000000e27beebfc37e0c
+RX 040e08014dfc00c50104ec
+TX 014dfc05a040210004
+RX 0000000b0000000b000000030000000000e27beebfc403b0
+RX 040e08014dfc000000005e
+TX 014dfc050441210004
+RX 0000000b0000000b000000030000000000e27beebfc48af4
+RX 040e08014dfc0001c401ac
+TX 014dfc056841210004
+RX 0000000b0000000b000000030000000000e27beebfc50eab
+RX 040e08014dfc00d90000e1
+TX 014dfc05cc41210004
+RX 0000000b0000000b000000030000000000e27beebfc58f7c
+RX 040e08014dfc0001c4016c
+TX 014dfc053042210004
+RX 0000000b0000000b000000030000000000e27beebfc6124e
+RX 040e08014dfc00e00000e8
+TX 014dfc059442210004
+RX 0000000b0000000b000000030000000000e27beebfc69521
+RX 040e08014dfc0001648c58
+TX 014dfc05f842210004
+RX 0000000b0000000b000000030000000000e27beebfc799ac
+RX 040e08014dfc00ff000301
+TX 014dfc055c43210004
+RX 0000000b0000000b000000030000000000e27beebfc7f96c
+RX 040e08014dfc005f000055
+TX 014dfc05c043210004
+RX 0000000b0000000b000000030000000000e27beebfc8be02
+RX 040e08014dfc0000001000
+TX 014dfc052444210004
+RX 0000000b0000000b000000030000000000e27beebfc97cd4
+RX 040e08014dfc00f40757b8
+TX 014dfc058844210004
+RX 0000000b0000000b000000030000000000e27beebfc9fb7f
+RX 040e08014dfc0000001400
+TX 014dfc05ec44210004
+RX 0000000b0000000b000000030000000000e27beebfca7b49
+RX 040e08014dfc0000040000
+TX 014dfc055045210004
+RX 0000000b0000000b000000030000000000e27beebfcaf1bd
+RX 040e08014dfc0000002c00
+TX 014dfc05b445210004
+RX 0000000b0000000b000000030000000000e27beebfcb4f74
+RX 040e08014dfc0000100000
+TX 014dfc051846210004
+RX 0000000b0000000b000000030000000000e27beebfcbc8f9
+RX 040e08014dfc007c0a50bc
+TX 014dfc057c46210004
+RX 0000000b0000000b000000030000000000e27beebfcc4c7c
+RX 040e08014dfc0008040007
+TX 014dfc05e046210004
+RX 0000000b0000000b000000030000000000e27beebfcccdd1
+RX 040e08014dfc0000000400
+TX 014dfc054447210004
+RX 0000000b0000000b000000030000000000e27beebfcd61ba
+RX 040e08014dfc0000010301
+TX 014dfc05a847210004
+RX 0000000b0000000b000000030000000000e27beebfcdd9d4
+RX 040e08014dfc0015032003
+TX 014dfc050c48210004
+RX 0000000b0000000b000000030000000000e27beebfce573c
+RX 040e08014dfc00fb010502
+TX 014dfc057048210004
+RX 0000000b0000000b000000030000000000e27beebfced915
+RX 040e08014dfc006a023402
+TX 014dfc05d448210004
+RX 0000000b0000000b000000030000000000e27beebfcf5e63
+RX 040e08014dfc0003db03a2
+TX 014dfc053849210004
+RX 0000000b0000000b000000030000000000e27beebfcfe29a
+RX 040e08014dfc0098492100
+TX 014dfc059c49210004
+RX 0000000b0000000b000000030000000000e27beebfd07253
+RX 040e08014dfc0001a901e0
+TX 014dfc05004a210004
+RX 0000000b0000000b000000030000000000e27beebfd0f677
+RX 040e08014dfc0003540397
+TX 014dfc05644a210004
+RX 0000000b0000000b000000030000000000e27beebfd177de
+RX 040e08014dfc00402020e0
+TX 014dfc05c84a210004
+RX 0000000b0000000b000000030000000000e27beebfd1ecc8
+RX 040e08014dfc00030105f8
+TX 014dfc052c4b210004
+RX 0000000b0000000b000000030000000000e27beebfd27677
+RX 040e08014dfc0004000400
+TX 014dfc05904b210004
+RX 0000000b0000000b000000030000000000e27beebfd2f7ed
+RX 040e08014dfc0062005100
+TX 014dfc05f44b210004
+RX 0000000b0000000b000000030000000000e27beebfd377f2
+RX 040e08014dfc0002000200
+TX 014dfc05584c210004
+RX 0000000b0000000b000000030000000000e27beebfd3fa30
+RX 040e08014dfc0000000000
+TX 014dfc05bc4c210004
+RX 0000000b0000000b000000030000000000e27beebfd47ac6
+RX 040e08014dfc0098036000
+TX 014dfc05204d210004
+RX 0000000b0000000b000000030000000000e27beebfd4faa6
+RX 040e08014dfc0000000000
+TX 014dfc05844d210004
+RX 0000000b0000000b000000030000000000e27beebfd57b25
+RX 040e08014dfc002e61319e
+TX 014dfc05e84d210004
+RX 0000000b0000000b000000030000000000e27beebfd68943
+RX 040e08014dfc0000000000
+TX 014dfc054c4e210004
+RX 0000000b0000000b000000030000000000e27beebfd6e941
+RX 040e08014dfc0000000000
+TX 014dfc05dc06200030
+RX 0000003700000037000000030000000000e27beebfd76aa7
+RX 040e34014dfc00fc0620000c011400b84d2100c44e2100120126e200000000000000001100c658e8af200040040a00a8622100a8622100
+TX 014dfc05b84d210004
+RX 0000000b0000000b000000030000000000e27beebfd7ee80
+RX 040e08014dfc0000000000
+TX 014dfc05c84e210004
+RX 0000000b0000000b000000030000000000e27beebfd96b03
+RX 040e08014dfc003f700000
+TX 014dfc05d84f210004
+RX 0000000b0000000b000000030000000000e27beebfda244b
+RX 040e08014dfc0020533819
+TX 014dfc05e850210004
+RX 0000000b0000000b000000030000000000e27beebfda66a2
+RX 040e08014dfc0013001001
+TX 014dfc05f851210004
+RX 0000000b0000000b000000030000000000e27beebfdb1dc1
+RX 040e08014dfc0010010f25
+TX 014dfc050853210004
+RX 0000000b0000000b000000030000000000e27beebfdb7163
+RX 040e08014dfc0000e25213
+TX 014dfc051854210004
+RX 0000000b0000000b000000030000000000e27beebfdbf1d4
+RX 040e08014dfc00010f42ec
+TX 014dfc052855210004
+RX 0000000b0000000b000000030000000000e27beebfdc6f47
+RX 040e08014dfc005194ac0a
+TX 014dfc053856210004
+RX 0000000b0000000b000000030000000000e27beebfdcb335
+RX 040e08014dfc00da0700ba
+TX 014dfc054857210004
+RX 0000000b0000000b000000030000000000e27beebfdd2fda
+RX 040e08014dfc000016f194
+TX 014dfc055858210004
+RX 0000000b0000000b000000030000000000e27beebfddad73
+RX 040e08014dfc00f1feba00
+TX 014dfc056859210004
+RX 0000000b0000000b000000030000000000e27beebfde2c17
+RX 040e08014dfc00be000022
+TX 014dfc05785a210004
+RX 0000000b0000000b000000030000000000e27beebfdeab0c
+RX 040e08014dfc000010010f
+TX 014dfc05885b210004
+RX 0000000b0000000b000000030000000000e27beebfdf3561
+RX 040e08014dfc000000e807
+TX 014dfc05985c210004
+RX 0000000b0000000b000000030000000000e27beebfdfb04a
+RX 040e08014dfc00b8000072
+TX 014dfc05a85d210004
+RX 0000000b0000000b000000030000000000e27beebfe0406a
+RX 040e08014dfc00030008f1
+TX 014dfc05b85e210004
+RX 0000000b0000000b000000030000000000e27beebfe0b02f
+RX 040e08014dfc0087f04cbe
+TX 014dfc05c85f210004
+RX 0000000b0000000b000000030000000000e27beebfe13b72
+RX 040e08014dfc0008b90000
+TX 014dfc05d860210004
+RX 0000000b0000000b000000030000000000e27beebfe1b919
+RX 040e08014dfc000c01003a
+TX 014dfc05e861210004
+RX 0000000b0000000b000000030000000000e27beebfe23d75
+RX 040e08014dfc001936c92b
+TX 014dfc05fc06200030
+RX 0000003700000037000000030000000000e27beebfe2d3c5
+RX 040e34014dfc00e8af200040040a00a8622100a86221000a006a1400000000000000000a006b3f7be9b581f1177b3f21f7dd9df06e0ae2
+TX 014dfc05a862210004
+RX 0000000b0000000b000000030000000000e27beebfe3be35
+RX 040e08014dfc00e8662100
+TX 014dfc05ec66210004
+RX 0000000b0000000b000000030000000000e27beebfe43b8f
+RX 040e08014dfc00c350d687
+TX 014dfc05306b210004
+RX 0000000b0000000b000000030000000000e27beebfe4bb96
+RX 040e08014dfc00e3c78237
+TX 014dfc05746f210004
+RX 0000000b0000000b000000030000000000e27beebfe53d42
+RX 040e08014dfc0019aac824
+TX 014dfc05b873210004
+RX 0000000b0000000b000000030000000000e27beebfe5cb61
+RX 040e08014dfc0069d31cf3
+TX 014dfc05fc77210004
+RX 0000000b0000000b000000030000000000e27beebfe62cc9
+RX 040e08014dfc003d11e110
+TX 014dfc05407c210004
+RX 0000000b0000000b000000030000000000e27beebfe6edcb
+RX 040e08014dfc0027e57831
+TX 014dfc058480210004
+RX 0000000b0000000b000000030000000000e27beebfe7abd5
+RX 040e08014dfc00fcdaacf0
+TX 014dfc05c884210004
+RX 0000000b0000000b000000030000000000e27beebfe82d02
+RX 040e08014dfc007ffa8079
+TX 014dfc050c89210004
+RX 0000000b0000000b000000030000000000e27beebfe8ad55
+RX 040e08014dfc000de1ad99
+TX 014dfc05e8af200030
+RX 0000003700000037000000030000000000e27beebfe92db8
+RX 040e34014dfc0008b020002c040400288d2100288d21000400000000000000000000000400000028b0200044041000d89d2100d89d2100
+TX 014dfc05288d210004
+RX 0000000b0000000b000000030000000000e27beebfea302d
+RX 040e08014dfc0054912100
+TX 014dfc055891210004
+RX 0000000b0000000b000000030000000000e27beebfeab08c
+RX 040e08014dfc00b437b423
+TX 014dfc058895210004
+RX 0000000b0000000b000000030000000000e27beebfeb6dbf
+RX 040e08014dfc00f7ab1031
+TX 014dfc05b899210004
+RX 0000000b0000000b000000030000000000e27beebfec2d1e
+RX 040e08014dfc001bbf2c9c
+TX 014dfc0508b0200030
+RX 0000003700000037000000030000000000e27beebfeced03
+RX 040e34014dfc0028b0200044041000d89d2100d89d21001000000000000000000000001000000048b0200008010f0018e2210018e22100
+TX 014dfc05d89d210004
+RX 0000000b0000000b000000030000000000e27beebfee2b3a
+RX 040e08014dfc001ca22100
+TX 014dfc0520a2210004
+RX 0000000b0000000b000000030000000000e27beebfeeb20b
+RX 040e08014dfc0030c8795b
+TX 014dfc0568a6210004
+RX 0000000b0000000b000000030000000000e27beebfef3414
+RX 040e08014dfc0061d5fb13
+TX 014dfc05b0aa210004
+RX 0000000b0000000b000000030000000000e27beebfefb326
+RX 040e08014dfc008a3dc78e
+TX 014dfc05f8ae210004
+RX 0000000b0000000b000000030000000000e27beebff037e1
+RX 040e08014dfc00c9dcb769
+TX 014dfc0540b3210004
+RX 0000000b0000000b000000030000000000e27beebff0bcf1
+RX 040e08014dfc00e2722f0c
+TX 014dfc0588b7210004
+RX 0000000b0000000b000000030000000000e27beebff13a07
+RX 040e08014dfc006c0b98fc
+TX 014dfc05d0bb210004
+RX 0000000b0000000b000000030000000000e27beebff1b621
+RX 040e08014dfc00101603ea
+TX 014dfc0518c0210004
+RX 0000000b0000000b000000030000000000e27beebff238f0
+RX 040e08014dfc005c915487
+TX 014dfc0560c4210004
+RX 0000000b0000000b000000030000000000e27beebff2c19c
+RX 040e08014dfc00cb41f3b2
+TX 014dfc05a8c8210004
+RX 0000000b0000000b000000030000000000e27beebff343ab
+RX 040e08014dfc00db93b18f
+TX 014dfc05f0cc210004
+RX 0000000b0000000b000000030000000000e27beebff3c416
+RX 040e08014dfc005c5ca405
+TX 014dfc0538d1210004
+RX 0000000b0000000b000000030000000000e27beebff44634
+RX 040e08014dfc00fd2d6388
+TX 014dfc0580d5210004
+RX 0000000b0000000b000000030000000000e27beebff49ff4
+RX 040e08014dfc00c17ab6d8
+TX 014dfc05c8d9210004
+RX 0000000b0000000b000000030000000000e27beebff52099
+RX 040e08014dfc00355e57a9
+TX 014dfc0510de210004
+RX 0000000b0000000b000000030000000000e27beebff59fe5
+RX 040e08014dfc00e4b02aa9
+TX 014dfc0528b0200030
+RX 0000003700000037000000030000000000e27beebff623a6
+RX 040e34014dfc0048b0200008010f0018e2210018e221000f00000000000000000000000f0000000000000008010f0090f1210090f12100
+TX 014dfc0518e2210004
+RX 0000000b0000000b000000030000000000e27beebff6a64a
+RX 040e08014dfc0020e32100
+TX 014dfc0524e3210004
+RX 0000000b0000000b000000030000000000e27beebff72534
+RX 040e08014dfc0000000000
+TX 014dfc0530e4210004
+RX 0000000b0000000b000000030000000000e27beebff7a5ab
+RX 040e08014dfc0000000000
+TX 014dfc053ce5210004
+RX 0000000b0000000b000000030000000000e27beebff82694
+RX 040e08014dfc0000000000
+TX 014dfc0548e6210004
+RX 0000000b0000000b000000030000000000e27beebff8a61a
+RX 040e08014dfc0000000000
+TX 014dfc0554e7210004
+RX 0000000b0000000b000000030000000000e27beebff927c7
+RX 040e08014dfc0000000000
+TX 014dfc0560e8210004
+RX 0000000b0000000b000000030000000000e27beebff9a88a
+RX 040e08014dfc0000000000
+TX 014dfc056ce9210004
+RX 0000000b0000000b000000030000000000e27beebffa2be9
+RX 040e08014dfc0000000000
+TX 014dfc0578ea210004
+RX 0000000b0000000b000000030000000000e27beebffb2a19
+RX 040e08014dfc0000000000
+TX 014dfc0584eb210004
+RX 0000000b0000000b000000030000000000e27beebffba771
+RX 040e08014dfc0000000000
+TX 014dfc0590ec210004
+RX 0000000b0000000b000000030000000000e27beebffc2aab
+RX 040e08014dfc0000000000
+TX 014dfc059ced210004
+RX 0000000b0000000b000000030000000000e27beebffcab4a
+RX 040e08014dfc0000000000
+TX 014dfc05a8ee210004
+RX 0000000b0000000b000000030000000000e27beebffd2dfe
+RX 040e08014dfc0000000000
+TX 014dfc05b4ef210004
+RX 0000000b0000000b000000030000000000e27beebffdadbc
+RX 040e08014dfc0000000000
+TX 014dfc05c0f0210004
+RX 0000000b0000000b000000030000000000e27beebffe2cdf
+RX 040e08014dfc0000000000
+TX 014dfc0548b0200030
+RX 0000003700000037000000030000000000e27beebffeae8a
+RX 040e34014dfc000000000008010f0090f1210090f121000f00000000000000000000000f00000000000000000000000000000000000000
+TX 014dfc0590f1210004
+RX 0000000b0000000b000000030000000000e27beebfff6dfb
+RX 040e08014dfc0098f22100
+TX 014dfc059cf2210004
+RX 0000000b0000000b000000030000000000e27beec0002edc
+RX 040e08014dfc0000000000
+TX 014dfc05a8f3210004
+RX 0000000b0000000b000000030000000000e27beec000acf4
+RX 040e08014dfc0000000000
+TX 014dfc05b4f4210004
+RX 0000000b0000000b000000030000000000e27beec0012d10
+RX 040e08014dfc0000000000
+TX 014dfc05c0f5210004
+RX 0000000b0000000b000000030000000000e27beec001b570
+RX 040e08014dfc0000000000
+TX 014dfc05ccf6210004
+RX 0000000b0000000b000000030000000000e27beec0027363
+RX 040e08014dfc0000000000
+TX 014dfc05d8f7210004
+RX 0000000b0000000b000000030000000000e27beec00333bd
+RX 040e08014dfc0000000000
+TX 014dfc05e4f8210004
+RX 0000000b0000000b000000030000000000e27beec003b50a
+RX 040e08014dfc0000000000
+TX 014dfc05f0f9210004
+RX 0000000b0000000b000000030000000000e27beec00452d7
+RX 040e08014dfc0000000000
+TX 014dfc05fcfa210004
+RX 0000000b0000000b000000030000000000e27beec004d362
+RX 040e08014dfc0000000000
+TX 014dfc0508fc210004
+RX 0000000b0000000b000000030000000000e27beec0055367
+RX 040e08014dfc0000000000
+TX 014dfc0514fd210004
+RX 0000000b0000000b000000030000000000e27beec005da0f
+RX 040e08014dfc0000000000
+TX 014dfc0520fe210004
+RX 0000000b0000000b000000030000000000e27beec0065a28
+RX 040e08014dfc0000000000
+TX 014dfc052cff210004
+RX 0000000b0000000b000000030000000000e27beec006dc92
+RX 040e08014dfc0000000000
+TX 014dfc053800220004
+RX 0000000b0000000b000000030000000000e27beec0075df4
+RX 040e08014dfc0000000000
+Socket closed

tests/traces/adbcore/info_heap_s8_verbose.trace.broken

@@ -0,0 +1,749 @@
+# info heap
+TX 01011000
+RX 0000000f0000000f000000030000000000e27beec8b0011f
+RX 040e0c01011000094f01090f001a41
+TX 014dfc057c06200004
+RX 0000000b0000000b000000030000000000e27beec8b0ab75
+RX 040e08014dfc009c062000
+TX 014dfc059c06200030
+RX 0000003700000037000000030000000000e27beec8b13874
+RX 040e34014dfc00bc06200020006000782a2100d82a21005f02047300000000000000005c00b8ebdc06200060003e007836210078362100
+TX 014dfc05782a210004
+RX 0000000b0000000b000000030000000000e27beec8b1968c
+RX 040e08014dfc00982a2100
+TX 014dfc059c2a210004
+RX 0000000b0000000b000000030000000000e27beec8b23944
+RX 040e08014dfc0011287ed9
+TX 014dfc05c02a210004
+RX 0000000b0000000b000000030000000000e27beec8b29a21
+RX 040e08014dfc00004dfc05
+TX 014dfc05e42a210004
+RX 0000000b0000000b000000030000000000e27beec8b33aae
+RX 040e08014dfc00fc00004d
+TX 014dfc05082b210004
+RX 0000000b0000000b000000030000000000e27beec8b37f1a
+RX 040e08014dfc00057e2f20
+TX 014dfc052c2b210004
+RX 0000000b0000000b000000030000000000e27beec8b3e241
+RX 040e08014dfc0055382000
+TX 014dfc05502b210004
+RX 0000000b0000000b000000030000000000e27beec8b43f00
+RX 040e08014dfc00ffff0100
+TX 014dfc05742b210004
+RX 0000000b0000000b000000030000000000e27beec8b46a99
+RX 040e08014dfc0000000000
+TX 014dfc05982b210004
+RX 0000000b0000000b000000030000000000e27beec8b4b5d5
+RX 040e08014dfc00b82b2100
+TX 014dfc05bc2b210004
+RX 0000000b0000000b000000030000000000e27beec8b4e534
+RX 040e08014dfc000000ffff
+TX 014dfc05e02b210004
+RX 0000000b0000000b000000030000000000e27beec8b523d8
+RX 040e08014dfc0000000010
+TX 014dfc05042c210004
+RX 0000000b0000000b000000030000000000e27beec8b561a8
+RX 040e08014dfc00ffff0038
+TX 014dfc05282c210004
+RX 0000000b0000000b000000030000000000e27beec8b5a092
+RX 040e08014dfc00e000004c
+TX 014dfc054c2c210004
+RX 0000000b0000000b000000030000000000e27beec8b5df4b
+RX 040e08014dfc0065000000
+TX 014dfc05702c210004
+RX 0000000b0000000b000000030000000000e27beec8b63e6f
+RX 040e08014dfc006500a800
+TX 014dfc05942c210004
+RX 0000000b0000000b000000030000000000e27beec8b69dc6
+RX 040e08014dfc00d0010300
+TX 014dfc05b82c210004
+RX 0000000b0000000b000000030000000000e27beec8b6fe4f
+RX 040e08014dfc00d82c2100
+TX 014dfc05dc2c210004
+RX 0000000b0000000b000000030000000000e27beec8b7a8cc
+RX 040e08014dfc0000000000
+TX 014dfc05002d210004
+RX 0000000b0000000b000000030000000000e27beec8b7e80c
+RX 040e08014dfc0000000000
+TX 014dfc05242d210004
+RX 0000000b0000000b000000030000000000e27beec8b8277b
+RX 040e08014dfc00ffff80ff
+TX 014dfc05482d210004
+RX 0000000b0000000b000000030000000000e27beec8b86891
+RX 040e08014dfc0000000500
+TX 014dfc056c2d210004
+RX 0000000b0000000b000000030000000000e27beec8b8a877
+RX 040e08014dfc0000ec0301
+TX 014dfc05902d210004
+RX 0000000b0000000b000000030000000000e27beec8b8ebbf
+RX 040e08014dfc0045432000
+TX 014dfc05b42d210004
+RX 0000000b0000000b000000030000000000e27beec8b92b29
+RX 040e08014dfc0000010003
+TX 014dfc05d82d210004
+RX 0000000b0000000b000000030000000000e27beec8b96b91
+RX 040e08014dfc00f82d2100
+TX 014dfc05fc2d210004
+RX 0000000b0000000b000000030000000000e27beec8b98474
+RX 040e08014dfc0000ff0000
+TX 014dfc05202e210004
+RX 0000000b0000000b000000030000000000e27beec8b9c3f1
+RX 040e08014dfc0000a80360
+TX 014dfc05442e210004
+RX 0000000b0000000b000000030000000000e27beec8ba06bd
+RX 040e08014dfc0014000000
+TX 014dfc05682e210004
+RX 0000000b0000000b000000030000000000e27beec8ba44df
+RX 040e08014dfc002f000000
+TX 014dfc058c2e210004
+RX 0000000b0000000b000000030000000000e27beec8ba835b
+RX 040e08014dfc005f000000
+TX 014dfc05b02e210004
+RX 0000000b0000000b000000030000000000e27beec8bae302
+RX 040e08014dfc002f000000
+TX 014dfc05d42e210004
+RX 0000000b0000000b000000030000000000e27beec8bb85b9
+RX 040e08014dfc002f000000
+TX 014dfc05f82e210004
+RX 0000000b0000000b000000030000000000e27beec8bbc904
+RX 040e08014dfc00182f2100
+TX 014dfc051c2f210004
+RX 0000000b0000000b000000030000000000e27beec8bbef32
+RX 040e08014dfc0022000000
+TX 014dfc05402f210004
+RX 0000000b0000000b000000030000000000e27beec8bc4199
+RX 040e08014dfc0000000000
+TX 014dfc05642f210004
+RX 0000000b0000000b000000030000000000e27beec8bca3a8
+RX 040e08014dfc0000000000
+TX 014dfc05882f210004
+RX 0000000b0000000b000000030000000000e27beec8bcc56e
+RX 040e08014dfc00002f0000
+TX 014dfc05ac2f210004
+RX 0000000b0000000b000000030000000000e27beec8bce06f
+RX 040e08014dfc00006f0000
+TX 014dfc05d02f210004
+RX 0000000b0000000b000000030000000000e27beec8bd0d72
+RX 040e08014dfc00002f0000
+TX 014dfc05f42f210004
+RX 0000000b0000000b000000030000000000e27beec8bd2064
+RX 040e08014dfc00002f0000
+TX 014dfc051830210004
+RX 0000000b0000000b000000030000000000e27beec8bd3b8d
+RX 040e08014dfc0038302100
+TX 014dfc053c30210004
+RX 0000000b0000000b000000030000000000e27beec8bd65e7
+RX 040e08014dfc0000220000
+TX 014dfc056030210004
+RX 0000000b0000000b000000030000000000e27beec8bd7805
+RX 040e08014dfc0000000000
+TX 014dfc058430210004
+RX 0000000b0000000b000000030000000000e27beec8bda250
+RX 040e08014dfc0000000000
+TX 014dfc05a830210004
+RX 0000000b0000000b000000030000000000e27beec8bdb5ea
+RX 040e08014dfc0006000000
+TX 014dfc05cc30210004
+RX 0000000b0000000b000000030000000000e27beec8bdcfa5
+RX 040e08014dfc00034100ff
+TX 014dfc05f030210004
+RX 0000000b0000000b000000030000000000e27beec8bdfa1c
+RX 040e08014dfc00a594a534
+TX 014dfc051431210004
+RX 0000000b0000000b000000030000000000e27beec8be0bd5
+RX 040e08014dfc0000ff0080
+TX 014dfc053831210004
+RX 0000000b0000000b000000030000000000e27beec8be3670
+RX 040e08014dfc0058312100
+TX 014dfc055c31210004
+RX 0000000b0000000b000000030000000000e27beec8be4d2b
+RX 040e08014dfc00ffef3df1
+TX 014dfc058031210004
+RX 0000000b0000000b000000030000000000e27beec8be67d6
+RX 040e08014dfc00034100ff
+TX 014dfc05a431210004
+RX 0000000b0000000b000000030000000000e27beec8be925f
+RX 040e08014dfc002800ac01
+TX 014dfc05c831210004
+RX 0000000b0000000b000000030000000000e27beec8bea504
+RX 040e08014dfc0028000000
+TX 014dfc05ec31210004
+RX 0000000b0000000b000000030000000000e27beec8bed190
+RX 040e08014dfc0000400000
+TX 014dfc051032210004
+RX 0000000b0000000b000000030000000000e27beec8bf1d55
+RX 040e08014dfc0000ffffff
+TX 014dfc053432210004
+RX 0000000b0000000b000000030000000000e27beec8bf4820
+RX 040e08014dfc0000000005
+TX 014dfc055832210004
+RX 0000000b0000000b000000030000000000e27beec8bf65bc
+RX 040e08014dfc0078322100
+TX 014dfc057c32210004
+RX 0000000b0000000b000000030000000000e27beec8bfa62f
+RX 040e08014dfc0000002000
+TX 014dfc05a032210004
+RX 0000000b0000000b000000030000000000e27beec8bfe6ad
+RX 040e08014dfc00a3ce1400
+TX 014dfc05c432210004
+RX 0000000b0000000b000000030000000000e27beec8c02906
+RX 040e08014dfc00eb049005
+TX 014dfc05e832210004
+RX 0000000b0000000b000000030000000000e27beec8c068f2
+RX 040e08014dfc0045064506
+TX 014dfc050c33210004
+RX 0000000b0000000b000000030000000000e27beec8c0c6e8
+RX 040e08014dfc006004a104
+TX 014dfc053033210004
+RX 0000000b0000000b000000030000000000e27beec8c0ec44
+RX 040e08014dfc0026052605
+TX 014dfc055433210004
+RX 0000000b0000000b000000030000000000e27beec8c14a80
+RX 040e08014dfc00ffac02ff
+TX 014dfc057833210004
+RX 0000000b0000000b000000030000000000e27beec8c1aa6b
+RX 040e08014dfc0098332100
+TX 014dfc059c33210004
+RX 0000000b0000000b000000030000000000e27beec8c1eda3
+RX 040e08014dfc00c004ffc4
+TX 014dfc05c033210004
+RX 0000000b0000000b000000030000000000e27beec8c22ef6
+RX 040e08014dfc003c323232
+TX 014dfc05e433210004
+RX 0000000b0000000b000000030000000000e27beec8c271ed
+RX 040e08014dfc0010101010
+TX 014dfc050834210004
+RX 0000000b0000000b000000030000000000e27beec8c2d0c3
+RX 040e08014dfc0077777777
+TX 014dfc052c34210004
+RX 0000000b0000000b000000030000000000e27beec8c2ffeb
+RX 040e08014dfc006f6f6f0f
+TX 014dfc055034210004
+RX 0000000b0000000b000000030000000000e27beec8c34a6d
+RX 040e08014dfc0074078c8c
+TX 014dfc057434210004
+RX 0000000b0000000b000000030000000000e27beec8c3a9f6
+RX 040e08014dfc00ff060100
+TX 014dfc059834210004
+RX 0000000b0000000b000000030000000000e27beec8c44939
+RX 040e08014dfc00b8342100
+TX 014dfc05bc34210004
+RX 0000000b0000000b000000030000000000e27beec8c4a8d6
+RX 040e08014dfc009f747474
+TX 014dfc05e034210004
+RX 0000000b0000000b000000030000000000e27beec8c4e0e9
+RX 040e08014dfc009f9f9f9f
+TX 014dfc050435210004
+RX 0000000b0000000b000000030000000000e27beec8c516f9
+RX 040e08014dfc007f7f7f7f
+TX 014dfc052835210004
+RX 0000000b0000000b000000030000000000e27beec8c55b3f
+RX 040e08014dfc007272727c
+TX 014dfc054c35210004
+RX 0000000b0000000b000000030000000000e27beec8c5ba24
+RX 040e08014dfc0004eb04eb
+TX 014dfc057035210004
+RX 0000000b0000000b000000030000000000e27beec8c5f023
+RX 040e08014dfc0006450645
+TX 014dfc059435210004
+RX 0000000b0000000b000000030000000000e27beec8c62f77
+RX 040e08014dfc0004600460
+TX 014dfc05b835210004
+RX 0000000b0000000b000000030000000000e27beec8c68ce1
+RX 040e08014dfc00d8352100
+TX 014dfc05dc35210004
+RX 0000000b0000000b000000030000000000e27beec8c6f0d3
+RX 040e08014dfc00ffa802ff
+TX 014dfc050036210004
+RX 0000000b0000000b000000030000000000e27beec8c72cf5
+RX 040e08014dfc0007ffc807
+TX 014dfc052436210004
+RX 0000000b0000000b000000030000000000e27beec8c76a48
+RX 040e08014dfc00bc04ffc0
+TX 014dfc054836210004
+RX 0000000b0000000b000000030000000000e27beec8c7977a
+RX 040e08014dfc003c3c3c3c
+TX 014dfc056c36210004
+RX 0000000b0000000b000000030000000000e27beec8c7d576
+RX 040e08014dfc003c3c3c50
+TX 014dfc059036210004
+RX 0000000b0000000b000000030000000000e27beec8c816d5
+RX 040e08014dfc002100d82a
+TX 014dfc05b436210004
+RX 0000000b0000000b000000030000000000e27beec8c85767
+RX 040e08014dfc0021000000
+TX 014dfc05d836210004
+RX 0000000b0000000b000000030000000000e27beec8c89933
+RX 040e08014dfc0038372100
+TX 014dfc05fc36210004
+RX 0000000b0000000b000000030000000000e27beec8c8def2
+RX 040e08014dfc00077f0006
+TX 014dfc052037210004
+RX 0000000b0000000b000000030000000000e27beec8c91e7f
+RX 040e08014dfc0005ca05ca
+TX 014dfc054437210004
+RX 0000000b0000000b000000030000000000e27beec8c95e25
+RX 040e08014dfc00ff14ff14
+TX 014dfc056837210004
+RX 0000000b0000000b000000030000000000e27beec8c99e18
+RX 040e08014dfc004b5a5a5a
+TX 014dfc058c37210004
+RX 0000000b0000000b000000030000000000e27beec8c9e152
+RX 040e08014dfc0001030105
+TX 014dfc05b037210004
+RX 0000000b0000000b000000030000000000e27beec8ca1f93
+RX 040e08014dfc00646c2000
+TX 014dfc05d437210004
+RX 0000000b0000000b000000030000000000e27beec8ca5f0c
+RX 040e08014dfc00fdf9f5f1
+TX 014dfc05bc06200030
+RX 0000003700000037000000030000000000e27beec8cab627
+RX 040e34014dfc00dc06200060003e0078362100783621003e02252100000000000000003d00d187fc0620000c011400b84d2100c44e2100
+TX 014dfc057836210004
+RX 0000000b0000000b000000030000000000e27beec8cb54a0
+RX 040e08014dfc00d8362100
+TX 014dfc05dc36210004
+RX 0000000b0000000b000000030000000000e27beec8cbb5e5
+RX 040e08014dfc00078c8c8c
+TX 014dfc054037210004
+RX 0000000b0000000b000000030000000000e27beec8cc553c
+RX 040e08014dfc00ff14ff14
+TX 014dfc05a437210004
+RX 0000000b0000000b000000030000000000e27beec8ccb5d4
+RX 040e08014dfc0001030105
+TX 014dfc050838210004
+RX 0000000b0000000b000000030000000000e27beec8cd1876
+RX 040e08014dfc0000000000
+TX 014dfc056c38210004
+RX 0000000b0000000b000000030000000000e27beec8cd5de5
+RX 040e08014dfc0010101010
+TX 014dfc05d038210004
+RX 0000000b0000000b000000030000000000e27beec8cd9d16
+RX 040e08014dfc000a0602fe
+TX 014dfc053439210004
+RX 0000000b0000000b000000030000000000e27beec8cdddaa
+RX 040e08014dfc0004080c10
+TX 014dfc059839210004
+RX 0000000b0000000b000000030000000000e27beec8ce306b
+RX 040e08014dfc0000000003
+TX 014dfc05fc39210004
+RX 0000000b0000000b000000030000000000e27beec8cee84e
+RX 040e08014dfc00706f7d75
+TX 014dfc05603a210004
+RX 0000000b0000000b000000030000000000e27beec8cff073
+RX 040e08014dfc0071718d87
+TX 014dfc05c43a210004
+RX 0000000b0000000b000000030000000000e27beec8d0283c
+RX 040e08014dfc0050615d54
+TX 014dfc05283b210004
+RX 0000000b0000000b000000030000000000e27beec8d07100
+RX 040e08014dfc0058666d60
+TX 014dfc058c3b210004
+RX 0000000b0000000b000000030000000000e27beec8d10a0d
+RX 040e08014dfc000a07ee03
+TX 014dfc05f03b210004
+RX 0000000b0000000b000000030000000000e27beec8d16ebd
+RX 040e08014dfc007d756d75
+TX 014dfc05543c210004
+RX 0000000b0000000b000000030000000000e27beec8d1e50b
+RX 040e08014dfc008d877c81
+TX 014dfc05b83c210004
+RX 0000000b0000000b000000030000000000e27beec8d26209
+RX 040e08014dfc005d54575f
+TX 014dfc051c3d210004
+RX 0000000b0000000b000000030000000000e27beec8d2dcc5
+RX 040e08014dfc006d605c6c
+TX 014dfc05803d210004
+RX 0000000b0000000b000000030000000000e27beec8d3255a
+RX 040e08014dfc000e782220
+TX 014dfc05e43d210004
+RX 0000000b0000000b000000030000000000e27beec8d39f84
+RX 040e08014dfc000d0d0d0d
+TX 014dfc05483e210004
+RX 0000000b0000000b000000030000000000e27beec8d42163
+RX 040e08014dfc000000000d
+TX 014dfc05ac3e210004
+RX 0000000b0000000b000000030000000000e27beec8d46fa9
+RX 040e08014dfc00c4012c53
+TX 014dfc05103f210004
+RX 0000000b0000000b000000030000000000e27beec8d4ee2f
+RX 040e08014dfc0000005d5d
+TX 014dfc05743f210004
+RX 0000000b0000000b000000030000000000e27beec8d5a95c
+RX 040e08014dfc00c401ec53
+TX 014dfc05d83f210004
+RX 0000000b0000000b000000030000000000e27beec8d6df0b
+RX 040e08014dfc0038402100
+TX 014dfc053c40210004
+RX 0000000b0000000b000000030000000000e27beec8d760ab
+RX 040e08014dfc00c50104ec
+TX 014dfc05a040210004
+RX 0000000b0000000b000000030000000000e27beec8d7dd87
+RX 040e08014dfc000000005e
+TX 014dfc050441210004
+RX 0000000b0000000b000000030000000000e27beec8d8589b
+RX 040e08014dfc0001c401ac
+TX 014dfc056841210004
+RX 0000000b0000000b000000030000000000e27beec8d8d892
+RX 040e08014dfc00d90000e1
+TX 014dfc05cc41210004
+RX 0000000b0000000b000000030000000000e27beec8d9936f
+RX 040e08014dfc0001c4016c
+TX 014dfc053042210004
+RX 0000000b0000000b000000030000000000e27beec8daca68
+RX 040e08014dfc00e00000e8
+TX 014dfc059442210004
+RX 0000000b0000000b000000030000000000e27beec8db80fd
+RX 040e08014dfc0001648c58
+TX 014dfc05f842210004
+RX 0000000b0000000b000000030000000000e27beec8dbc58e
+RX 040e08014dfc00ff000301
+TX 014dfc055c43210004
+RX 0000000b0000000b000000030000000000e27beec8dc800d
+RX 040e08014dfc005f000055
+TX 014dfc05c043210004
+RX 0000000b0000000b000000030000000000e27beec8dcc4b1
+RX 040e08014dfc0000001000
+TX 014dfc052444210004
+RX 0000000b0000000b000000030000000000e27beec8dd4471
+RX 040e08014dfc00f40757b8
+TX 014dfc058844210004
+RX 0000000b0000000b000000030000000000e27beec8de00c2
+RX 040e08014dfc0000001400
+TX 014dfc05ec44210004
+RX 0000000b0000000b000000030000000000e27beec8debd7a
+RX 040e08014dfc0000040000
+TX 014dfc055045210004
+RX 0000000b0000000b000000030000000000e27beec8df388c
+RX 040e08014dfc0000002c00
+TX 014dfc05b445210004
+RX 0000000b0000000b000000030000000000e27beec8dfb15c
+RX 040e08014dfc0000100000
+TX 014dfc051846210004
+RX 0000000b0000000b000000030000000000e27beec8e02d31
+RX 040e08014dfc007c0a50bc
+TX 014dfc057c46210004
+RX 0000000b0000000b000000030000000000e27beec8e0f1d2
+RX 040e08014dfc0008040007
+TX 014dfc05e046210004
+RX 0000000b0000000b000000030000000000e27beec8e135fd
+RX 040e08014dfc0000000400
+TX 014dfc054447210004
+RX 0000000b0000000b000000030000000000e27beec8e2360e
+RX 040e08014dfc0000010301
+TX 014dfc05a847210004
+RX 0000000b0000000b000000030000000000e27beec8e2b095
+RX 040e08014dfc0015032003
+TX 014dfc050c48210004
+RX 0000000b0000000b000000030000000000e27beec8e36a06
+RX 040e08014dfc00fb010502
+TX 014dfc057048210004
+RX 0000000b0000000b000000030000000000e27beec8e3b071
+RX 040e08014dfc006a023402
+TX 014dfc05d448210004
+RX 0000000b0000000b000000030000000000e27beec8e42f49
+RX 040e08014dfc0003db03a2
+TX 014dfc053849210004
+RX 0000000b0000000b000000030000000000e27beec8e4abd2
+RX 040e08014dfc0098492100
+TX 014dfc059c49210004
+RX 0000000b0000000b000000030000000000e27beec8e56bb6
+RX 040e08014dfc0001a901e0
+TX 014dfc05004a210004
+RX 0000000b0000000b000000030000000000e27beec8e62b2e
+RX 040e08014dfc0003540397
+TX 014dfc05644a210004
+RX 0000000b0000000b000000030000000000e27beec8e65871
+RX 040e08014dfc00402020e0
+TX 014dfc05c84a210004
+RX 0000000b0000000b000000030000000000e27beec8e6d1ac
+RX 040e08014dfc00030105f8
+TX 014dfc052c4b210004
+RX 0000000b0000000b000000030000000000e27beec8e72cb7
+RX 040e08014dfc0004000400
+TX 014dfc05904b210004
+RX 0000000b0000000b000000030000000000e27beec8e7c71f
+RX 040e08014dfc0062005100
+TX 014dfc05f44b210004
+RX 0000000b0000000b000000030000000000e27beec8e82358
+RX 04
+RX 0e08014dfc0002000200
+TX 014dfc05584c210004
+RX 0000000b0000000b000000030000000000e27beec8e844c3
+RX 040e08014dfc0000000000
+TX 014dfc05bc4c210004
+RX 0000000b0000000b000000030000000000e27beec8e8a3de
+RX 040e08014dfc0098036000
+TX 014dfc05204d210004
+RX 0000000b0000000b000000030000000000e27beec8e949b9
+RX 040e08014dfc0000000000
+TX 014dfc05844d210004
+RX 0000000b0000000b000000030000000000e27beec8e986dd
+RX 040e08014dfc002e61319e
+TX 014dfc05e84d210004
+RX 0000000b0000000b000000030000000000e27beec8ea05c9
+RX 040e08014dfc0000000000
+TX 014dfc054c4e210004
+RX 0000000b0000000b000000030000000000e27beec8ea8359
+RX 040e08014dfc0000000000
+TX 014dfc05dc06200030
+RX 0000003700000037000000030000000000e27beec8eb0ffe
+RX 040e34014dfc00fc0620000c011400b84d2100c44e2100120126e200000000000000001100c658e8af200040040a00a8622100a8622100
+TX 014dfc05b84d210004
+RX 0000000b0000000b000000030000000000e27beec8eb4ccb
+RX 040e08014dfc0000000000
+TX 014dfc05c84e210004
+RX 0000000b0000000b000000030000000000e27beec8ebcd42
+RX 040e08014dfc003f700000
+TX 014dfc05d84f210004
+RX 0000000b0000000b000000030000000000e27beec8ec0e9c
+RX 040e08014dfc0020533819
+TX 014dfc05e850210004
+RX 0000000b0000000b000000030000000000e27beec8ec5f52
+RX 040e08014dfc0013001001
+TX 014dfc05f851210004
+RX 0000000b0000000b000000030000000000e27beec8ecdb92
+RX 040e08014dfc0010010f25
+TX 014dfc050853210004
+RX 0000000b0000000b000000030000000000e27beec8ed50ea
+RX 040e08014dfc0000e25213
+TX 014dfc051854210004
+RX 0000000b0000000b000000030000000000e27beec8edd384
+RX 04
+RX 0e08014dfc00010f42ec
+TX 014dfc052855210004
+RX 0000000b0000000b000000030000000000e27beec8ee4bb8
+RX 040e08014dfc005194ac0a
+TX 014dfc053856210004
+RX 0000000b0000000b000000030000000000e27beec8ee8701
+RX 040e08014dfc00da0700ba
+TX 014dfc054857210004
+RX 0000000b0000000b000000030000000000e27beec8eec66b
+RX 040e08014dfc000016f194
+TX 014dfc055858210004
+RX 0000000b0000000b000000030000000000e27beec8ef0557
+RX 040e08014dfc00f1feba00
+TX 014dfc056859210004
+RX 0000000b0000000b000000030000000000e27beec8ef42d1
+RX 040e08014dfc00be000022
+TX 014dfc05785a210004
+RX 0000000b0000000b000000030000000000e27beec8efa354
+RX 040e08014dfc000010010f
+TX 014dfc05885b210004
+RX 0000000b0000000b000000030000000000e27beec8f02fd3
+RX 040e08014dfc000000e807
+TX 014dfc05985c210004
+RX 0000000b0000000b000000030000000000e27beec8f0af07
+RX 040e08014dfc00b8000072
+TX 014dfc05a85d210004
+RX 0000000b0000000b000000030000000000e27beec8f12d71
+RX 040e08014dfc00030008f1
+TX 014dfc05b85e210004
+RX 0000000b0000000b000000030000000000e27beec8f18d3a
+RX 040e08014dfc0087f04cbe
+TX 014dfc05c85f210004
+RX 0000000b0000000b000000030000000000e27beec8f20d89
+RX 040e08014dfc0008b90000
+TX 014dfc05d860210004
+RX 0000000b0000000b000000030000000000e27beec8f28f39
+RX 040e08014dfc000c01003a
+TX 014dfc05e861210004
+RX 0000000b0000000b000000030000000000e27beec8f34ef0
+RX 040e08014dfc001936c92b
+TX 014dfc05fc06200030
+RX 0000003700000037000000030000000000e27beec8f4887c
+RX 040e34014dfc00e8af200040040a00a8622100a86221000a006a1400000000000000000a006b3f7be9b581f1177b3f21f7dd9df06e0ae2
+TX 014dfc05a862210004
+RX 0000000b0000000b000000030000000000e27beec8f5452d
+RX 040e08014dfc00e8662100
+TX 014dfc05ec66210004
+RX 0000000b0000000b000000030000000000e27beec8f587b4
+RX 040e08014dfc00c350d687
+TX 014dfc05306b210004
+RX 0000000b0000000b000000030000000000e27beec8f603b5
+RX 040e08014dfc00e3c78237
+TX 014dfc05746f210004
+RX 0000000b0000000b000000030000000000e27beec8f6c570
+RX 040e08014dfc0019aac824
+TX 014dfc05b873210004
+RX 0000000b0000000b000000030000000000e27beec8f78596
+RX 040e08014dfc0069d31cf3
+TX 014dfc05fc77210004
+RX 0000000b0000000b000000030000000000e27beec8f83e69
+RX 040e08014dfc003d11e110
+TX 014dfc05407c210004
+RX 0000000b0000000b000000030000000000e27beec8f87ff8
+RX 040e08014dfc0027e57831
+TX 014dfc058480210004
+RX 0000000b0000000b000000030000000000e27beec8f90b52
+RX 040e08014dfc00fcdaacf0
+TX 014dfc05c884210004
+RX 0000000b0000000b000000030000000000e27beec8f9836b
+RX 040e08014dfc007ffa8079
+TX 014dfc050c89210004
+RX 0000000b0000000b000000030000000000e27beec8f9fb7d
+RX 040e08014dfc000de1ad99
+TX 014dfc05e8af200030
+RX 0000003700000037000000030000000000e27beec8fa77a3
+RX 040e34014dfc0008b020002c040400288d2100288d21000400000000000000000000000400000028b0200044041000d89d2100d89d2100
+TX 014dfc05288d210004
+RX 0000000b0000000b000000030000000000e27beec8faf0d8
+RX 040e08014dfc0054912100
+TX 014dfc055891210004
+RX 0000000b0000000b000000030000000000e27beec8fba912
+RX 040e08014dfc00b437b423
+TX 014dfc058895210004
+RX 0000000b0000000b000000030000000000e27beec8fce262
+RX 040e08014dfc00f7ab1031
+TX 014dfc05b899210004
+RX 0000000b0000000b000000030000000000e27beec8fd9559
+RX 040e08014dfc001bbf2c9c
+TX 014dfc0508b0200030
+RX 0000003700000037000000030000000000e27beec8fde150
+RX 040e34014dfc0028b0200044041000d89d2100d89d21001000000000000000000000001000000048b0200008010f0018e2210018e22100
+TX 014dfc05d89d210004
+RX 0000000b0000000b000000030000000000e27beec8fe5bbf
+RX 040e08014dfc001ca22100
+TX 014dfc0520a2210004
+RX 0000000b0000000b000000030000000000e27beec8fed310
+RX 040e08014dfc0030c8795b
+TX 014dfc0568a6210004
+RX 0000000b0000000b000000030000000000e27beec8ff4e98
+RX 040e08014dfc0061d5fb13
+TX 014dfc05b0aa210004
+RX 0000000b0000000b000000030000000000e27beec9000666
+RX 040e08014dfc008a3dc78e
+TX 014dfc05f8ae210004
+RX 0000000b0000000b000000030000000000e27beec9013b64
+RX 040e08014dfc00c9dcb769
+TX 014dfc0540b3210004
+RX 0000000b0000000b000000030000000000e27beec901f5f6
+RX 040e08014dfc00e2722f0c
+TX 014dfc0588b7210004
+RX 0000000b0000000b000000030000000000e27beec90243ad
+RX 040e08014dfc006c0b98fc
+TX 014dfc05d0bb210004
+RX 0000000b0000000b000000030000000000e27beec902bba8
+RX 040e08014dfc00101603ea
+TX 014dfc0518c0210004
+RX 0000000b0000000b000000030000000000e27beec9033534
+RX 040e08014dfc005c915487
+TX 014dfc0560c4210004
+RX 0000000b0000000b000000030000000000e27beec903b1b4
+RX 040e08014dfc00cb41f3b2
+TX 014dfc05a8c8210004
+RX 0000000b0000000b000000030000000000e27beec903f22c
+RX 040e08014dfc00db93b18f
+TX 014dfc05f0cc210004
+RX 0000000b0000000b000000030000000000e27beec9046edb
+RX 040e08014dfc005c5ca405
+TX 014dfc0538d1210004
+RX 0000000b0000000b000000030000000000e27beec904f985
+RX 040e08014dfc00fd2d6388
+TX 014dfc0580d5210004
+RX 0000000b0000000b000000030000000000e27beec9056232
+RX 040e08014dfc00c17ab6d8
+TX 014dfc05c8d9210004
+RX 0000000b0000000b000000030000000000e27beec9059ba7
+RX 040e08014dfc00355e57a9
+TX 014dfc0510de210004
+RX 0000000b0000000b000000030000000000e27beec9060d61
+RX 040e08014dfc00e4b02aa9
+TX 014dfc0528b0200030
+RX 0000003700000037000000030000000000e27beec90675ed
+RX 040e34014dfc0048b0200008010f0018e2210018e221000f00000000000000000000000f0000000000000008010f0090f1210090f12100
+TX 014dfc0518e2210004
+RX 0000000b0000000b000000030000000000e27beec906f599
+RX 040e08014dfc0020e32100
+TX 014dfc0524e3210004
+RX 0000000b0000000b000000030000000000e27beec9077a41
+RX 040e08014dfc0000000000
+TX 014dfc0530e4210004
+RX 0000000b0000000b000000030000000000e27beec90800c4
+RX 040e08014dfc0000000000
+TX 014dfc053ce5210004
+RX 0000000b0000000b000000030000000000e27beec9087b8b
+RX 040e08014dfc0000000000
+TX 014dfc0548e6210004
+RX 0000000b0000000b000000030000000000e27beec908f918
+RX 040e08014dfc0000000000
+TX 014dfc0554e7210004
+RX 0000000b0000000b000000030000000000e27beec9097805
+RX 040e08014dfc0000000000
+TX 014dfc0560e8210004
+RX 0000000b0000000b000000030000000000e27beec90a7c3c
+RX 040e08014dfc0000000000
+TX 014dfc056ce9210004
+RX 0000000b0000000b000000030000000000e27beec90af9a6
+RX 040e08014dfc0000000000
+TX 014dfc0578ea210004
+RX 0000000b0000000b000000030000000000e27beec90b7674
+RX 040e08014dfc0000000000
+TX 014dfc0584eb210004
+RX 0000000b0000000b000000030000000000e27beec90c3303
+RX 040e08014dfc0000000000
+TX 014dfc0590ec210004
+RX 0000000b0000000b000000030000000000e27beec90d6914
+RX 04
+RX 0e08014dfc0000000000
+TX 014dfc059ced210004
+RX 0000000b0000000b000000030000000000e27beec90e27ef
+RX 040e08014dfc0000000000
+TX 014dfc05a8ee210004
+RX 0000000b0000000b000000030000000000e27beec90f63b6
+RX 040e08014dfc0000000000
+TX 014dfc05b4ef210004
+RX 0000000b0000000b000000030000000000e27beec91021bb
+RX 040e08014dfc0000000000
+TX 014dfc05c0f0210004
+RX 0000000b0000000b000000030000000000e27beec9106e47
+RX 040e08014dfc0000000000
+TX 014dfc0548b0200030
+RX 0000003700000037000000030000000000e27beec910ef09
+RX 040e34014dfc000000000008010f0090f1210090f121000f00000000000000000000000f00000000000000000000000000000000000000
+TX 014dfc0590f1210004
+RX 0000000b0000000b000000030000000000e27beec9117983
+RX 040e08014dfc0098f22100
+TX 014dfc059cf2210004
+RX 0000000b0000000b000000030000000000e27beec911f917
+RX 040e08014dfc0000000000
+TX 014dfc05a8f3210004
+RX 0000000b0000000b000000030000000000e27beec9127344
+RX 040e08014dfc0000000000
+TX 014dfc05b4f4210004
+RX 0000000b0000000b000000030000000000e27beec912f035
+RX 040e08014dfc0000000000
+TX 014dfc05c0f5210004
+RX 0000000b0000000b000000030000000000e27beec9136ada
+RX 040e08014dfc0000000000
+TX 014dfc05ccf6210004
+RX 0000000b0000000b000000030000000000e27beec913e4a2
+RX 040e08014dfc0000000000
+TX 014dfc05d8f7210004
+RX 0000000b0000000b000000030000000000e27beec9149bb2
+RX 040e08014dfc0000000000
+TX 014dfc05e4f8210004
+RX 0000000b0000000b000000030000000000e27beec9155ada
+RX 040e08014dfc0000000000
+TX 014dfc05f0f9210004
+RX 0000000b0000000b000000030000000000e27beec91614ec
+RX 040e08014dfc0000000000
+TX 014dfc05fcfa210004
+RX 0000000b0000000b000000030000000000e27beec916d569
+RX 040e08014dfc0000000000
+TX 014dfc0508fc210004
+RX 0000000b0000000b000000030000000000e27beec9174ca5
+RX 040e08014dfc0000000000
+TX 014dfc0514fd210004
+RX 0000000b0000000b000000030000000000e27beec918072d
+RX 040e08014dfc0000000000
+TX 014dfc0520fe210004
+RX 0000000b0000000b000000030000000000e27beec9184a5a
+RX 040e08014dfc0000000000
+TX 014dfc052cff210004
+RX 0000000b0000000b000000030000000000e27beec918c2f1
+RX 040e08014dfc0000000000
+TX 014dfc053800220004
+RX 0000000b0000000b000000030000000000e27beec9197cf2
+RX 040e08014dfc0000000000
+Socket closed

tests/traces/adbcore/info_heap_verbose.trace

@@ -0,0 +1,673 @@
+#info heap verbose
+TX 010300011000
+RX 00000004
+RX 00000004
+RX 00000002
+RX 00000000
+RX 00e269c2
+RX 24f45277
+RX 01
+RX 011000
+RX 0000000f
+RX 0000000f
+RX 00000003
+RX 00000000
+RX 00e269c2
+RX 24f49bf7
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc059430200004
+RX 000000030000000300000003
+RX 0000000000e269c224f66ff7
+RX 07f001
+RX 00000009
+RX 00000009000000020000000000e269c2
+RX 24f6d31f
+RX 014dfc059430200004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 24f70f36
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05c85d200030
+RX 0000000900000009000000020000000000e269c224f82dac
+RX 014dfc05c85d200030
+RX 00000037
+RX 00000037000000030000000000e269c2
+RX 24f8351d
+RX 040e34014dfc00434f4c42000000000700000008000000a4792100a479210020010000200000000000000000000000f85d200068ec2000
+TX 0108004dfc05a479210004
+RX 0000000900000009000000020000000000e269c224f96863
+RX 01
+RX 4dfc05a479210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 24f96f9b
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05c879210004
+RX 0000000900000009000000020000000000e269c224fa033d
+RX 014dfc05c879210004
+RX 0000000b0000000b
+RX 000000030000000000e269c224fa0a66
+RX 040e08014dfc00587a2100
+TX 0108004dfc05ec79210004
+RX 00000009000000090000000200000000
+RX 00e269c224faa230
+RX 01
+RX 4dfc05ec79210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 24fac81f
+RX 040e08014dfc007c7a2100
+TX 0108004dfc05107a210004
+RX 0000000900000009000000020000000000e269c224fbaae4
+RX 014dfc05107a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 24fbd8f3
+RX 040e08014dfc00c8792100
+TX 0108004dfc05347a210004
+RX 0000000900000009000000020000000000e269c224fd9b54
+RX 014dfc05347a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 24fdce26
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05587a210004
+RX 0000000900000009000000020000000000e269c224ff1027
+RX 01
+RX 4dfc05587a210004
+RX 0000000b0000000b
+RX 000000030000000000e269c224ff3f90
+RX 040e08014dfc00ec792100
+TX 0108004dfc057c7a210004
+RX 000000090000000900000002
+RX 0000000000e269c225010a6e
+RX 014dfc057c7a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 25013f2d
+RX 040e08014dfc00a07a2100
+TX 0108004dfc05a07a210004
+RX 0000000900000009000000020000000000e269c22502fae6
+RX 01
+RX 4dfc05a07a210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c225032df8
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc05f85d200030
+RX 0000000900000009000000020000000000e269c2250476e7
+RX 014dfc05f85d200030
+RX 00000037
+RX 00000037000000030000000000e269c2
+RX 2504a4d2
+RX 040e34014dfc00434f4c42000000000700000008000000087b2100c47a210020020000400000000000000000000000285e2000c85d2000
+TX 0108004dfc05c47a210004
+RX 000000090000000900000002
+RX 0000000000e269c225066c76
+RX 014dfc05c47a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c22506a5f8
+RX 040e08014dfc00087b2100
+TX 0108004dfc05087b210004
+RX 0000000900000009000000020000000000e269c22507e065
+RX 014dfc05087b210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c225080920
+RX 04
+RX 0e08014dfc004c7b2100
+TX 0108004dfc054c7b210004
+RX 000000090000000900000002
+RX 0000000000e269c2
+RX 2509ddbe
+RX 014dfc054c7b210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2250a11f3
+RX 04
+RX 0e08014dfc00907b2100
+TX 0108004dfc05907b210004
+RX 0000000900000009000000020000000000e269c2250b50dd
+RX 01
+RX 4dfc05907b210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2250b8020
+RX 040e08014dfc00d47b2100
+TX 0108004dfc05d47b210004
+RX 0000000900000009000000020000000000e269c2
+RX 250d460e
+RX 014dfc05d47b210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2250d78d8
+RX 04
+RX 0e08014dfc00187c2100
+TX 0108004dfc05187c210004
+RX 0000000900000009000000020000000000e269c2
+RX 250f38a4
+RX 014dfc05187c210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2250f6cd6
+RX 04
+RX 0e08014dfc005c7c2100
+TX 0108004dfc055c7c210004
+RX 0000000900000009000000020000000000e269c2
+RX 2510b373
+RX 014dfc055c7c210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c22510e1a3
+RX 04
+RX 0e08014dfc00a07c2100
+TX 0108004dfc05a07c210004
+RX 000000090000000900000002
+RX 0000000000e269c22512a9bc
+RX 014dfc05a07c210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c22512f3eb
+RX 040e08014dfc0000000000
+TX 0108004dfc05285e200030
+RX 000000090000000900000002
+RX 0000000000e269c22513f86b
+RX 014dfc05285e200030
+RX 0000003700000037000000030000000000e269c2251400aa
+RX 040e34014dfc00434f4c42000000000a0000000a000000e47c2100e47c2100780a0000080100000000000000000000885e2000f85d2000
+TX 0108004dfc05e47c210004
+RX 000000090000000900000002
+RX 0000000000e269c225146c16
+RX 014dfc05e47c210004
+RX 0000000b0000000b000000030000000000e269c225147351
+RX 04
+RX 0e08014dfc00f07d2100
+TX 0108004dfc05f07d210004
+RX 00000009000000090000000200000000
+RX 00e269c22514e723
+RX 014dfc05f07d210004
+RX 0000000b0000000b000000030000000000e269c2
+RX 2514ef3f
+RX 040e08014dfc00fc7e2100
+TX 0108004dfc05fc7e210004
+RX 0000000900000009
+RX 000000020000000000e269c2251561bc
+RX 014dfc05fc7e210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c2251569c1
+RX 040e08014dfc0008802100
+TX 0108004dfc050880210004
+RX 0000000900000009000000020000000000e269c225158f04
+RX 01
+RX 4dfc050880210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c225159627
+RX 04
+RX 0e08014dfc0014812100
+TX 0108004dfc051481210004
+RX 0000000900000009000000020000000000e269c225165165
+RX 014dfc051481210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c225165ecc
+RX 04
+RX 0e08014dfc0020822100
+TX 0108004dfc052082210004
+RX 0000000900000009
+RX 000000020000000000e269c22517a5b9
+RX 014dfc052082210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c22517dfcd
+RX 04
+RX 0e08014dfc002c832100
+TX 0108004dfc052c83210004
+RX 0000000900000009
+RX 000000020000000000e269c2251932d1
+RX 014dfc052c83210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 2519667f
+RX 040e08014dfc0038842100
+TX 0108004dfc053884210004
+RX 000000090000000900000002
+RX 0000000000e269c2251b2a5a
+RX 014dfc053884210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 251b62c2
+RX 040e08014dfc0044852100
+TX 0108004dfc054485210004
+RX 0000000900000009000000020000000000e269c2
+RX 251ca298
+RX 014dfc054485210004
+RX 0000000b
+RX 0000000b00000003
+RX 0000000000e269c2251ccf7d
+RX 04
+RX 0e08014dfc0050862100
+TX 0108004dfc055086210004
+RX 0000000900000009000000020000000000e269c2251e9dc9
+RX 014dfc055086210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 251eca4e
+RX 040e08014dfc0000000000
+TX 0108004dfc05885e200030
+RX 0000000900000009000000020000000000e269c225200d49
+RX 014dfc05885e200030
+RX 0000003700000037
+RX 000000030000000000e269c2
+RX 25203a17
+RX 040e34014dfc00434f4c4200000000040000000400000024c6210024c62100b0100000280400000000000000000000585e2000285e2000
+TX 0108004dfc0524c6210004
+RX 0000000900000009000000020000000000e269c22522011f
+RX 01
+RX 4dfc0524c6210004
+RX 0000000b0000000b
+RX 000000030000000000e269c22522345d
+RX 040e08014dfc0050ca2100
+TX 0108004dfc0550ca210004
+RX 0000000900000009
+RX 000000020000000000e269c225237d84
+RX 014dfc0550ca210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 2523b746
+RX 040e08014dfc007cce2100
+TX 0108004dfc057cce210004
+RX 0000000900000009
+RX 000000020000000000e269c225257404
+RX 014dfc057cce210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c22525acbe
+RX 04
+RX 0e08014dfc00a8d22100
+TX 0108004dfc05a8d2210004
+RX 000000090000000900000002
+RX 0000000000e269c225276a22
+RX 014dfc05a8d2210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c22527a257
+RX 040e08014dfc0000000000
+TX 0108004dfc05585e200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 2528e2d0
+RX 014dfc05585e200030
+RX 00000037000000370000000300000000
+RX 00e269c2252917ea
+RX 040e34014dfc00434f4c42000000001000000010000000d4d62100d4d621008044000044040000000000000000000038ec2000885e2000
+TX 0108004dfc05d4d6210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 252ae41d
+RX 014dfc05d4d6210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 252b1c39
+RX 040e08014dfc001cdb2100
+TX 0108004dfc051cdb210004
+RX 0000000900000009000000020000000000e269c2252c605d
+RX 014dfc051cdb210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 252c8cf9
+RX 040e08014dfc0064df2100
+TX 0108004dfc0564df210004
+RX 0000000900000009000000020000000000e269c2252e57a3
+RX 014dfc0564df210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 252e85a1
+RX 040e08014dfc00ace32100
+TX 0108004dfc05ace3210004
+RX 0000000900000009000000020000000000e269c2252fc9e0
+RX 014dfc05ace3210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 252ffd27
+RX 040e08014dfc00f4e72100
+TX 0108004dfc05f4e7210004
+RX 0000000900000009000000020000000000e269c2
+RX 2531c79c
+RX 014dfc05f4e7210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c22531f9dc
+RX 04
+RX 0e08014dfc003cec2100
+TX 0108004dfc053cec210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 2533400d
+RX 014dfc053cec210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c22533748a
+RX 04
+RX 0e08014dfc0084f02100
+TX 0108004dfc0584f0210004
+RX 0000000900000009
+RX 000000020000000000e269c22535357b
+RX 014dfc0584f0210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 25356eb9
+RX 040e08014dfc00ccf42100
+TX 0108004dfc05ccf4210004
+RX 0000000900000009000000020000000000e269c225372b81
+RX 014dfc05ccf4210004
+RX 0000000b0000000b
+RX 000000030000000000e269c225375dab
+RX 040e08014dfc0014f92100
+TX 0108004dfc0514f9210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 2538a25a
+RX 014dfc0514f9210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c22538d60a
+RX 040e08014dfc005cfd2100
+TX 0108004dfc055cfd210004
+RX 0000000900000009000000020000000000e269c2
+RX 253a9899
+RX 014dfc055cfd210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2253acac3
+RX 040e08014dfc00a4012200
+TX 0108004dfc05a401220004
+RX 00000009000000090000000200000000
+RX 00e269c2253c0cd4
+RX 014dfc05a401220004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 253c44fa
+RX 040e08014dfc00ec052200
+TX 0108004dfc05ec05220004
+RX 000000090000000900000002
+RX 0000000000e269c2253e065b
+RX 014dfc05ec05220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 253e3a13
+RX 040e08014dfc00340a2200
+TX 0108004dfc05340a220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 253f7e4c
+RX 014dfc05340a220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 253fb262
+RX 040e08014dfc007c0e2200
+TX 0108004dfc057c0e220004
+RX 00000009
+RX 00000009000000020000000000e269c225417f42
+RX 014dfc057c0e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c2254263d7
+RX 04
+RX 0e08014dfc00c4122200
+TX 0108004dfc05c412220004
+RX 0000000900000009
+RX 000000020000000000e269c225437d34
+RX 014dfc05c412220004
+RX 0000000b0000000b000000030000000000e269c2
+RX 254385a8
+RX 040e08014dfc000c172200
+TX 0108004dfc050c17220004
+RX 00000009000000090000000200000000
+RX 00e269c22543f724
+RX 014dfc050c17220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c22543fe75
+RX 040e08014dfc0000000000
+TX 0108004dfc0538ec200030
+RX 000000090000000900000002
+RX 0000000000e269c22544730f
+RX 014dfc0538ec200030
+RX 00000037000000370000000300000000
+RX 00e269c225447a7b
+RX 040e34014dfc00434f4c42000000000f0000000f000000541b2200541b22009402000028000000000000000000000068ec2000585e2000
+TX 0108004dfc05541b220004
+RX 00000009000000090000000200000000
+RX 00e269c2254530d1
+RX 014dfc05541b220004
+RX 0000000b0000000b000000030000000000e269c22545384f
+RX 040e08014dfc00801b2200
+TX 0108004dfc05801b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 25468d97
+RX 014dfc05801b220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c22546c77f
+RX 04
+RX 0e08014dfc00ac1b2200
+TX 0108004dfc05ac1b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 25481812
+RX 014dfc05ac1b220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c2254851b1
+RX 040e08014dfc00d81b2200
+TX 0108004dfc05d81b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 254a0d3f
+RX 014dfc05d81b220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2254a4661
+RX 04
+RX 0e08014dfc00041c2200
+TX 0108004dfc05041c220004
+RX 000000090000000900000002
+RX 0000000000e269c2254b81c3
+RX 014dfc05041c220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 254bb640
+RX 040e08014dfc00301c2200
+TX 0108004dfc05301c220004
+RX 0000000900000009000000020000000000e269c2254d7a87
+RX 014dfc05301c220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 254da773
+RX 040e08014dfc005c1c2200
+TX 0108004dfc055c1c220004
+RX 0000000900000009000000020000000000e269c2254eeefc
+RX 014dfc055c1c220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 254f1cc7
+RX 040e08014dfc00881c2200
+TX 0108004dfc05881c220004
+RX 0000000900000009
+RX 000000020000000000e269c22550e1a7
+RX 014dfc05881c220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 25511a28
+RX 040e08014dfc00b41c2200
+TX 0108004dfc05b41c220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 2552563c
+RX 014dfc05b41c220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c225528970
+RX 040e08014dfc00e01c2200
+TX 0108004dfc05e01c220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 25545148
+RX 014dfc05e01c220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 255495c8
+RX 040e08014dfc000c1d2200
+TX 0108004dfc050c1d220004
+RX 000000090000000900000002
+RX 0000000000e269c225561274
+RX 014dfc050c1d220004
+RX 0000000b0000000b000000030000000000e269c225561a14
+RX 040e08014dfc00381d2200
+TX 0108004dfc05381d220004
+RX 000000090000000900000002
+RX 0000000000e269c22556cc48
+RX 014dfc05381d220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c22556d4c1
+RX 040e08014dfc00641d2200
+TX 0108004dfc05641d220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 255728b3
+RX 014dfc05641d220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2255730da
+RX 040e08014dfc00901d2200
+TX 0108004dfc05901d220004
+RX 0000000900000009000000020000000000e269c2255764bf
+RX 014dfc05901d220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 25576be4
+RX 040e08014dfc00bc1d2200
+TX 0108004dfc05bc1d220004
+RX 000000090000000900000002
+RX 0000000000e269c225580968
+RX 014dfc05bc1d220004
+RX 0000000b
+RX 0000000b000000030000000000e269c22558253a
+RX 040e08014dfc0000000000
+TX 0108004dfc0568ec200030
+RX 00000009000000090000000200000000
+RX 00e269c2255917c5
+RX 01
+RX 4dfc0568ec200030
+RX 0000003700000037
+RX 000000030000000000e269c225594aea
+RX 040e34014dfc00434f4c42000000000f0000000f000000e81d2200e81d22001c020000200000000000000000000000c85d200038ec2000
+TX 0108004dfc05e81d220004
+RX 0000000900000009000000020000000000e269c2255b0b9f
+RX 01
+RX 4dfc05e81d220004
+RX 0000000b0000000b
+RX 000000030000000000e269c2255b3e4e
+RX 040e08014dfc000c1e2200
+TX 0108004dfc050c1e220004
+RX 0000000900000009000000020000000000e269c2255c8003
+RX 01
+RX 4dfc050c1e220004
+RX 0000000b0000000b
+RX 000000030000000000e269c2255cae79
+RX 040e08014dfc00301e2200
+TX 0108004dfc05301e220004
+RX 0000000900000009000000020000000000e269c2255e7bc6
+RX 01
+RX 4dfc05301e220004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 255eaed6
+RX 040e08014dfc00541e2200
+TX 0108004dfc05541e220004
+RX 0000000900000009000000020000000000e269c225607f9d
+RX 014dfc05541e220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 2560adc6
+RX 040e08014dfc00781e2200
+TX 0108004dfc05781e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 2561ea26
+RX 014dfc05781e220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 25621fe0
+RX 040e08014dfc009c1e2200
+TX 0108004dfc059c1e220004
+RX 0000000900000009
+RX 0000000200000000
+RX 00e269c22563e445
+RX 014dfc059c1e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c22564180f
+RX 040e08014dfc00c01e2200
+TX 0108004dfc05c01e220004
+RX 0000000900000009000000020000000000e269c2
+RX 25655a07
+RX 014dfc05c01e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c2256587be
+RX 04
+RX 0e08014dfc00e41e2200
+TX 0108004dfc05e41e220004
+RX 0000000900000009000000020000000000e269c225674d06
+RX 014dfc05e41e220004
+RX 0000000b0000000b
+RX 000000030000000000e269c225677f9c
+RX 040e08014dfc00081f2200
+TX 0108004dfc05081f220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 2568c3c6
+RX 014dfc05081f220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c22568f76f
+RX 04
+RX 0e08014dfc002c1f2200
+TX 0108004dfc052c1f220004
+RX 000000090000000900000002
+RX 0000000000e269c2256aba6f
+RX 014dfc052c1f220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2256aee2f
+RX 040e08014dfc00501f2200
+TX 0108004dfc05501f220004
+RX 0000000900000009000000020000000000e269c2
+RX 256cb09e
+RX 014dfc05501f220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2256ce32b
+RX 04
+RX 0e08014dfc00741f2200
+TX 0108004dfc05741f220004
+RX 0000000900000009000000020000000000e269c2256e2691
+RX 014dfc05741f220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 256e5586
+RX 040e08014dfc00981f2200
+TX 0108004dfc05981f220004
+RX 0000000900000009
+RX 000000020000000000e269c2257024e1
+RX 014dfc05981f220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 25705949
+RX 040e08014dfc00bc1f2200
+TX 0108004dfc05bc1f220004
+RX 0000000900000009000000020000000000e269c2257195aa
+RX 014dfc05bc1f220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 2571c36f
+RX 040e08014dfc00e01f2200
+TX 0108004dfc05e01f220004
+RX 00000009000000090000000200000000
+RX 00e269c225738aa1
+RX 01
+RX 4dfc05e01f220004
+RX 0000000b0000000b
+RX 000000030000000000e269c22573c337
+RX 040e08014dfc0000000000
+Socket closed

tests/traces/adbcore/info_queue.trace

@@ -0,0 +1,148 @@
+# info queue
+TX 010300011000
+RX 0000000400000004000000020000000000e269c2663770fc
+RX 01011000
+RX 0000000f0000000f000000030000000000e269c26637a4a7
+RX 040e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc057c30200004
+RX 00000003000000030000000300000000
+RX 00e269c266390c8a
+RX 07f001
+RX 00000009
+RX 000000090000000200000000
+RX 00e269c2663974da
+RX 01
+RX 4dfc057c30200004
+RX 0000000b0000000b
+RX 000000030000000000e269c26639ac63
+RX 040e08014dfc0090652000
+TX 0108004dfc059065200038
+RX 000000090000000900000002
+RX 0000000000e269c2
+RX 663b4f1a
+RX 014dfc059065200038
+RX 0000003f0000003f0000000300000000
+RX 00e269c2663b83d8
+RX 040e3c014dfc00554555510000000001000000100000000000000010000000c8652000086620000466200004662000000000000000000044662000ecad2000
+TX 0108004dfc054466200038
+RX 000000090000000900000002
+RX 0000000000e269c2663d419c
+RX 014dfc054466200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 663d7aab
+RX 040e3c014dfc005545555100000000020000001f000000000000001f0000007c66200074672000ac662000ac66200000000000000000007467200090652000
+TX 0108004dfc057467200038
+RX 0000000900000009000000020000000000e269c2
+RX 663ebb9e
+RX 014dfc057467200038
+RX 0000003f0000003f00000003
+RX 0000000000e269c2663eeac6
+RX 040e3c014dfc00554555510000000001000000030000000000000003000000ac672000b8672000ac672000ac6720000000000000000000b867200044662000
+TX 0108004dfc05b867200038
+RX 0000000900000009000000020000000000e269c26640af70
+RX 01
+RX 4dfc05b867200038
+RX 0000003f0000003f
+RX 000000030000000000e269c2
+RX 6640e3ed
+RX 040e3c014dfc005545555100000000010000001f000000000000001f000000f06720006c682000f0672000f067200000000000000000006c68200074672000
+TX 0108004dfc056c68200038
+RX 0000000900000009000000020000000000e269c26642a534
+RX 014dfc056c68200038
+RX 0000003f
+RX 0000003f0000000300000000
+RX 00e269c26642d8cd
+RX 04
+RX 0e3c014dfc00554555510000000001000000140000000000000014000000a4682000f4682000e0682000e06820000000000000000000f4682000b8672000
+TX 0108004dfc05f468200038
+RX 0000000900000009000000020000000000e269c266441bec
+RX 014dfc05f468200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6644504f
+RX 040e3c014dfc005545555100000000020000000800000000000000080000002c6920006c6920002c6920002c69200000000000000000006c6920006c682000
+TX 0108004dfc056c69200038
+RX 000000090000000900000002
+RX 0000000000e269c2
+RX 664611cc
+RX 014dfc056c69200038
+RX 0000003f
+RX 0000003f0000000300000000
+RX 00e269c266464b12
+RX 04
+RX 0e3c014dfc00554555510000000002000000060000000000000006000000a4692000d4692000a4692000a46920000000000000000000d4692000f4682000
+TX 0108004dfc05d469200038
+RX 00000009000000090000000200000000
+RX 00e269c266478916
+RX 01
+RX 4dfc05d469200038
+RX 0000003f0000003f00000003
+RX 0000000000e269c26647be39
+RX 040e3c014dfc00554555510000000002000000010000000000000001000000100d2000180d2000100d2000100d200000000000000000000c6a20006c692000
+TX 0108004dfc050c6a200038
+RX 000000090000000900000002
+RX 0000000000e269c2664987ae
+RX 014dfc050c6a200038
+RX 0000003f0000003f
+RX 000000030000000000e269c2
+RX 6649bc49
+RX 040e3c014dfc00554555510000000002000000010000000000000001000000180d2000200d2000180d2000180d20000000000000000000446a2000d4692000
+TX 0108004dfc05446a200038
+RX 000000090000000900000002
+RX 0000000000e269c2664af918
+RX 014dfc05446a200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 664b2d9b
+RX 040e3c014dfc005545555100000000020000002000000000000000200000007c6a20007c6b20007c6a20007c6a20000000000000000000903320000c6a2000
+TX 0108004dfc059033200038
+RX 0000000900000009000000020000000000e269c2664cf025
+RX 014dfc059033200038
+RX 0000003f0000003f
+RX 000000030000000000e269c2
+RX 664d236e
+RX 040e3c014dfc005545555100000000020000000c000000000000000c0000009c732100fc732100ac732100ac7321000000000000000000705b2000446a2000
+TX 0108004dfc05705b200038
+RX 0000000900000009000000020000000000e269c2
+RX 664ee493
+RX 014dfc05705b200038
+RX 0000003f0000003f0000000300000000
+RX 00e269c2664f184e
+RX 04
+RX 0e3c014dfc00554555510000000001000000080000000000000008000000fc7321001c74210010742100107421000000000000000000c833200090332000
+TX 0108004dfc05c833200038
+RX 000000090000000900000002
+RX 0000000000e269c2665059ac
+RX 014dfc05c833200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6650912f
+RX 040e3c014dfc005545555100000000020000001300000000000000130000001c742100b47421001c7421001c7421000000000000000000b4512000705b2000
+TX 0108004dfc05b451200038
+RX 0000000900000009
+RX 000000020000000000e269c266525485
+RX 014dfc05b451200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6652883b
+RX 040e3c014dfc00554555510000000002000000060000000000000006000000b4742100e4742100b4742100b4742100000000000000000094ad2000c8332000
+TX 0108004dfc0594ad200038
+RX 000000090000000900000002
+RX 0000000000e269c26653c77b
+RX 014dfc0594ad200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6653fcfb
+RX 040e3c014dfc00554555510000000001000000080000000000000008000000ccad2000ecad2000ccad2000ccad20000000000000000000ecad2000b4512000
+TX 0108004dfc05ecad200038
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 6655bd0f
+RX 014dfc05ecad200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6655f6b7
+RX 040e3c014dfc0055455551000000000100000010000000000000001000000024ae200064ae200024ae200024ae200000000000000000009065200094ad2000
+Socket closed